Analysis
- max time kernel
132s - max time network
132s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
21/06/2024, 07:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe
- Size 946KB
- Sample240621-js74pswcnm
- SHA256 39954c7f2b6241653191f1b909c9c2d7b9e206573d95a2c9db6aa342b8203939
- MD5 8839e2581a5ef5dfd1bb25f481e6fb99
- SHA1 d67a97d859251410498a5628e70657c28ff8ab30
- SHA512 8bd66b359fba6ef14a7cf9ef19d43522ceca7bf905b234de34d14b45fcee9ad7afa98b58cdb0a9ed673bf493063abbe051e4d7f64985ca8fcfd544f34349e8ce
- SSDEEP 24576:O9BRa0veGEVv6DtieiXf9rYkkui6unVO4:O5a0GJVSD0nX1rYkWV5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 8 IoCs
pid Process 1784 minidownload.exe 2972 DownLoadDlg.exe 2704 ExternalApp.exe 1324 UpdateService.exe 1500 XLDownloadCom.exe 2056 UpdateService.exe 2632 MiniTPFw.exe 772 ThunderFW.exe - Loads dropped DLL 31 IoCs
pid Process 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 1784 minidownload.exe 1784 minidownload.exe 1784 minidownload.exe 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 2972 DownLoadDlg.exe 2704 ExternalApp.exe 2704 ExternalApp.exe 2704 ExternalApp.exe 556 regsvr32.exe 2320 regsvr32.exe 2704 ExternalApp.exe 2700 regsvr32.exe 2780 regsvr32.exe 1532 regsvr32.exe 876 regsvr32.exe 2704 ExternalApp.exe 2704 ExternalApp.exe 1324 UpdateService.exe 1324 UpdateService.exe 1324 UpdateService.exe 1500 XLDownloadCom.exe 1500 XLDownloadCom.exe 2280 regsvr32.exe 2972 DownLoadDlg.exe 2056 UpdateService.exe 2056 UpdateService.exe 2056 UpdateService.exe 2972 DownLoadDlg.exe 2972 DownLoadDlg.exe 2632 MiniTPFw.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020} regsvr32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe File opened for modification \??\PhysicalDrive0 DownLoadDlg.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini regsvr32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol regsvr32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI regsvr32.exe File opened for modification C:\Windows\System32\GroupPolicy regsvr32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\SogouDownLoad\html\images\warning.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\download\dl_peer_id.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\cooperation2.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-b\download.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-c\close.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\btns.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper\download.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\rocket2.swf minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\IEHint64.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\css\sedlhelper-c.css minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper\star1.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-b\close.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\js\cooperation.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\download.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-b\mainbg.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\error2.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_set.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_spr.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_t.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\xldl.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-b\titlebg.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\dlico1.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\errorbg2.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_close.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\download\download_engine.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\download\msvcr71.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-c\btn3.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\js\actions.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\download\ThunderFW.exe ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\npdownload64.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\uninst.exe ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\settings.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-c\slogan1.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\js\jquery-1.11.2.min.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-c\slogan3.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\bg_line.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\error.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\css\down.css minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\config.ini minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\repair.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper\selogo.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper-c\btn2.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\DlgHandler.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\download\MiniThunderPlatform.exe ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\npdownload.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\IEHint.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\css\sedlhelper.css minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\XLDownloadComPS.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\download\msvcp71.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe DownLoadDlg.exe File created C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\download\atl71.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\download\id.dat ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\html\cooperation\images\sedlhelper\mainbg.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\download\zlib1.dll ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe ExternalApp.exe File created C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe ExternalApp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x000d000000014713-1.dat nsis_installer_1 behavioral1/files/0x000d000000014713-1.dat nsis_installer_2 behavioral1/files/0x00050000000193bb-72.dat nsis_installer_1 behavioral1/files/0x00050000000193bb-72.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085} DownLoadDlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\AppName = "DownLoadDlg.exe" DownLoadDlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\AppPath = "C:\\Program Files (x86)\\SogouDownLoad" DownLoadDlg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\Policy = "3" DownLoadDlg.exe - Modifies data under HKEY_USERS 38 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-19 regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Key created \REGISTRY\USER\S-1-5-20 regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\NumMethods\ = "14" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\TypeLib XLDownloadCom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B411DAF2-77C4-4478-8477-5826A4147AE9}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouDownLoad\\npdownload64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D85F656-2970-437F-BA8A-C6F95B86EE0D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SogouDownLoad" XLDownloadCom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\InprocServer32\ = "C:\\Program Files (x86)\\SogouDownLoad\\IEHint.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ = "IXLDownloadInterface" XLDownloadCom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085} DownLoadDlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ = "C:\\Program Files (x86)\\SogouDownLoad\\npdownload.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\TypeLib\ = "{2D85F656-2970-437F-BA8A-C6F95B86EE0D}" XLDownloadCom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\ = "SogouDownLoadLib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35489C47-0C7C-48D8-8000-0FB159BAF406}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\SogouDownLoad\\XLDownloadCom.exe" XLDownloadCom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B411DAF2-77C4-4478-8477-5826A4147AE9}\InProcServer32\ = "C:\\Program Files (x86)\\SogouDownLoad\\XLDownloadComPS.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\LocalServer32\ = "C:\\Program Files (x86)\\SogouDownLoad\\DownLoadDlg.exe" DownLoadDlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{548F20C0-F980-4912-9190-1127D22D883D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\TypeLib\Version = "1.0" XLDownloadCom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548F20C0-F980-4912-9190-1127D22D883D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouDownLoad\\IEHint64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{548F20C0-F980-4912-9190-1127D22D883D}\ = "IIEHintBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35489C47-0C7C-48D8-8000-0FB159BAF406}\Version XLDownloadCom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ = "IDownLoadBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\ = "DownLoadBHO Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ = "IXLDownloadInterface" XLDownloadCom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SogouDownLoad" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548F20C0-F980-4912-9190-1127D22D883D}\TypeLib\ = "{459CB386-4301-448D-A1DA-8751857E980B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ = "C:\\Program Files (x86)\\SogouDownLoad\\npdownload64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35489C47-0C7C-48D8-8000-0FB159BAF406}\Version\ = "1.0" XLDownloadCom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\LocalServer32 DownLoadDlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\ = "IEHintBHO Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ProxyStubClsid32\ = "{B411DAF2-77C4-4478-8477-5826A4147AE9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\ = "DownLoadBHO Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 1784 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 28 PID 1664 wrote to memory of 2972 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 30 PID 1664 wrote to memory of 2972 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 30 PID 1664 wrote to memory of 2972 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 30 PID 1664 wrote to memory of 2972 1664 2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe 30 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2972 wrote to memory of 2704 2972 DownLoadDlg.exe 31 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 556 2704 ExternalApp.exe 32 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2320 2704 ExternalApp.exe 33 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2704 wrote to memory of 2700 2704 ExternalApp.exe 34 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2700 wrote to memory of 2780 2700 regsvr32.exe 35 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 2704 wrote to memory of 1532 2704 ExternalApp.exe 36 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 1532 wrote to memory of 876 1532 regsvr32.exe 37 PID 2704 wrote to memory of 1324 2704 ExternalApp.exe 38 PID 2704 wrote to memory of 1324 2704 ExternalApp.exe 38 PID 2704 wrote to memory of 1324 2704 ExternalApp.exe 38 PID 2704 wrote to memory of 1324 2704 ExternalApp.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-21_8839e2581a5ef5dfd1bb25f481e6fb99_mafia.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\minidownload.exeC:\Users\Admin\AppData\Local\Temp\\minidownload.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1784
-
-
C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe"C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe" /ExternalAppInstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe"C:\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe" /Update3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\npdownload.dll"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:556
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\IEHint.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2320
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\npdownload64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\SogouDownLoad\npdownload64.dll"5⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2780
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\IEHint64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\SogouDownLoad\IEHint64.dll"5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:876
-
-
-
C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe"C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe" /Install4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324
-
-
C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe"C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe" /Regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1500
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\XLDownloadComPS.dll"4⤵
- Loads dropped DLL
- Modifies registry class
PID:2280
-
-
-
C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe"C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Program Files (x86)\SogouDownLoad\download\ThunderFW.exe"C:\Program Files (x86)\SogouDownLoad\download\ThunderFW.exe" MiniThunderPlatform2024-06-2107:57:13 "C:\Program Files (x86)\SogouDownLoad\download\MiniThunderPlatform.exe"4⤵
- Executes dropped EXE
PID:772
-
-
-
-
C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe"C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe" /Service1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\SogouDownLoad\DlgHandler.dll
- Size 191KB
- SHA256 d4a4eb61a6ffba806c3f34fa6bb5fca32489f53138dbaf324a8b2d210afa0771
- MD5 87d4aa3496919af493c9365619c3fd53
- SHA1 a883a0be2940811ef9232592c811b854f684f4b7
- SHA512 064637554b7e7e1c5699f4e4ced73dd4ca7bf87172009b121bedeb864f8e3d03a1352b6f6b9515b9a4020137e07b9981476a664eadbd27bd32acdd8a53003372
- SSDEEP 3072:tnyhRb2nqYYl2oCpg9Q1S8lIRUJmPurNuPxde8FlDk:tnyhp2nJQ2oCpg9QYpUJNrpi4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe
- Size 761KB
- SHA256 bf4eb539657a396a18bcd473cdf95e29d1a46fb93745e176da6440e289c8aac8
- MD5 dd5ee7833d1e2c180e91d574403e087b
- SHA1 f71adfb34855aaf33632c008058e80c0d417e6c0
- SHA512 860a8f89545f8710888635646b6c6ccd0ad8d420bb435ad411d4b2adabe59b879e184db20931f3072db52d7aa226ecc6e56b825d9ec0ee1011836c842571d1bd
- SSDEEP 12288:J59LejC/Bvu4vvXWQXgd32RARgOdT0VkT5afjKzxCBwHFSDceiyFW:C4XX0QAFdTr9amzMBgFSDchyFW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SogouDownLoad\IEHint.dll
- Size 300KB
- SHA256 cd57765f8cea6a4f422862c0b8a3e1945f17292e4c14b31333ec1525e05c6025
- MD5 6cffe36e5e3d9364a18eaf4a44ebfc23
- SHA1 8a3bb3fa5f76a7eac5dfc4bd201a5e5203c10bcf
- SHA512 7e145a0a79bd3d8caa89bae2ddb1187ff4de481426bb820cdf8f0206c96819d38af0ade5aad6c9e89da4e11dad6d5ab692f3d8bb25b90da2596bf49619fe325b
- SSDEEP 6144:pJ/waTSN0c0Of/GB3uoz7RsuPL3H13A/Mv3s0vAJI4:pJ/lvcBG9j/RhPL3H13A/FN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SogouDownLoad\IEHint64.dll
- Size 346KB
- SHA256 3d3f8c1a05c2b5b5362b9ee0ddc1ce653a22abf0b559acceebcc82b73dbaf79a
- MD5 30e7e39b49c8590aec85aca2664ff3e7
- SHA1 8273c46fb4666e44ce3865012529aebb6aa95f1c
- SHA512 8d967605e4be98929cf6b508dccc217e60186da44dcb594d16e286f29b66c846dc1c4e676fab235de7f2326bcb4aae30528a535136de72f6a978a48d8a424245
- SSDEEP 6144:jSSfGRsfuhMlIAz9dSJ1TXLHWMAWPFlBKJJjMqJ+c2i3VS:jxbfdlIAz9q6WNYJj7JzA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SogouDownLoad\XLDownloadComPS.dll
- Size 42KB
- SHA256 a445ea86ffb20f9540d53aa12dc8f3737a9c87573241b9c5686109533b92e890
- MD5 ef217dde650c290e6f15bdbd7f55f26d
- SHA1 87ef4ca0ac1f7dd6c50bdaa0aeeebc3d1e132dcf
- SHA512 d2ae2574d2fa5455b590513066bdee9d3765bffd6b82450a5e619d01d4378013cbdcb4f0d9cec47ba7f03125098945c07cb0c6274a9a1ad0346bddd10fe022b5
- SSDEEP 768:hxc81voEpEYLhA0rHmnTED0/7vy5wmUD4ufM:51tdANNOymUD4ufM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe
- Size 58KB
- SHA256 f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100
- MD5 58bb62e88687791ad2ea5d8d6e3fe18b
- SHA1 0ffb029064741d10c9cf3f629202aa97167883de
- SHA512 cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5
- SSDEEP 768:BSODywYihzSrVPdQsNruuGYOLO3NNkFlBi1jSZIfjeGdJARt03juFGu:BSKywYDdQsQuG5L27Ui1SPRt0qf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SogouDownLoad\npdownload.dll
- Size 263KB
- SHA256 a93cce637743104e4d418eca05f238405b3e97672163d8abd1ad429045f843b6
- MD5 09c16c79a0093b38ef756c58c32d75e2
- SHA1 d6721cc14a1dd1879a923b38fd046d6e8b0f40df
- SHA512 eabb9237b5121e9755a01d4e9522513fbf5ea4594779d336fe373708933006b94d10a23a749efc623177296b1270337a63aab46d4990a0ee1f73df7ee8622f87
- SSDEEP 6144:A1eD3Y2FaBZbV5lzkq30GM9z3KJH7iGl7A7C8J0aU:A1ewBZbV5loq30G2z3cH7T7AZE
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\SogouDownLoad\CommonState.dll
- Size 83KB
- SHA256 d16b036fab037ef7f529c963a746e6963a552b7bf56bd6026db84028bd6aadb9
- MD5 6a695550741cdbafba406d0c7a9ebd00
- SHA1 32e9128129068e4524370fac7eba88ca9f6c109e
- SHA512 d4d15129e446fc1d5ac0d9688f775b83d736bb296617a86c93f0a6208931bb84936adab5e4e71339065dcd3d6ec6b1a2af189b8802409a2d4ab5f5556f85f81a
- SSDEEP 1536:2hEuroF0Z1qFr6wAPk89KfLszEQ8GkSLbfkzl2U86P4un:2hEuroFm1qFxxS8XkU8ODn
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\SogouDownLoad\XLDownloadCom.exe
- Size 133KB
- SHA256 67510f7dd0476f12e07901ac0344d92186dd761a52398ee1e835421382094f1b
- MD5 004dcd89684f7fc42d3c77edf80dfc92
- SHA1 8a086552df8c17ad146518757689f9237e27b87d
- SHA512 3a60493e77a7e59147d2b75bed788062d7482d922062d63a40ba3a050013736ce28e1f6319ba3eb7faecc44de9332ff571c028ea8582270d614d9659bf2769ac
- SSDEEP 3072:M3oAgmx3K9tUak6rRBUQH/3Hv38LJ8Rr8yn7ZWV1DH:bROSUNeUQH/mGl8m7Eb
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\SogouDownLoad\download\ThunderFW.exe
- Size 71KB
- SHA256 298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
- MD5 f0372ff8a6148498b19e04203dbb9e69
- SHA1 27fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8
- SHA512 65d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865
- SSDEEP 1536:BG9vRpkFqhyU/v47PZSOKhqTwYu5tEm1n22W:E1RIOAkz5tEmZvW
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\SogouDownLoad\npdownload64.dll
- Size 302KB
- SHA256 a4917bf56e25576632e808c5199c3c43eb21c866e4e6eb6747c79168f6044c57
- MD5 8523eee6d4c49b110e6c19ecfd7e5620
- SHA1 434ddf9f77f904812ef4c3c2329ce057b30dfdfc
- SHA512 bb916842beac0a605675dda9bf240b2f75437a61bbdd3d89fd464694167db7addb9fd6dd2fce482b9670c9c0e46eb9b3952cf538fb555ade10a9787f4081934a
- SSDEEP 6144:xn2xTPaW2z9Cc6vnCQOiFTl/1FCMLEnhPxqrzoZDgUHLpoK:l2pCWW9CZvnDOgUn91B
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe
- Size 2.4MB
- SHA256 905de1f8ab574888fa9dbe7bb5a060ca1c09f710fed2c98e3c2699e595343b79
- MD5 b58d945d3d2b83eb5199d60fc27d0e6a
- SHA1 3b70e368422bab5ff123d1ef6c5779adb540ef5a
- SHA512 027b6ab2197451dae5224c6f3417120d3b7e1ca5cb1801e4a952cac4b832deeacd16955bb3cb3c13553317685609eac6a2202ce8d2ab85837963a5a1478eacdd
- SSDEEP 49152:Ch9l7cda/tgrYJUGfZC3wA6EylfwEaFW6KkNTrxZMLS+H6JQy:o9l7catLxC3sEwwM6K0LMW+6Z
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\SogouDownLoad\update\UpdateService.exe
- Size 154KB
- SHA256 a1779be9ef6a3ec798578c0b79a279d34316872d8509eb37f62c98b2fe6af23f
- MD5 44f5df9407679e7385a0a3a925fbc39b
- SHA1 95681735e2b3e8d0296b39fb505a6e6644e2330b
- SHA512 bf02965127b81da708e13b519b822903de9999b797bbd0ed6697a39e95279511c9e9044d793ef69d9a11f3d518fce1ba85250bbe58c6255f660a09bced35c63f
- SSDEEP 3072:vc5cKNgbKb83ukQFQwoIEUG3V1z5R2xvoaAJBg7txJpGdVzDE:kMukQFNoIEUG3V95R2iaQytxJpGd9Q
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\minidownload.exe
- Size 544KB
- SHA256 ffba320baa8d6a30c9607c7cd4f374fed2bb6cc5d7ff2755a48967ae863de21a
- MD5 20e2fb49ffa668a6e54a80c78cfdc83d
- SHA1 811fe740eedc4d55a175c9a45aac1d5874f87ac1
- SHA512 ae8ac4fef0ed75b31d340eef14a86fbbb77dda053745275c156338cb29be77a91cb2d512eb41cc3fe476ceae946beba7b161186d61292bf893596af426b71e50
- SSDEEP 12288:X3zT5jido/EJRXfwAi0OzfyYxGkg1aFSkYu8DU0OYheu0O49gx:XDtieiXf9rYkkui6unVOj
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi4145.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP