3f8ec3ac729285705bbeff69bad1edada368ef5241d91d3eee878e4b0856bf52

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

泽华音乐/data/User/system32/BsradioVisualEffect.exe
Size

252KB
MD5

eee1fb5de6a13a0239882905a295640f
SHA1

ebe26bea86794e60a8e6f4b716e2f51454fde0af
SHA256

19c38d5776be6314a8a2cd3ce8f04c24d0efb918ca4e1d516943f2b87801af2e
SHA512

fd1e8346f80d4f5455bedc55b8f2bec1643debd5e809156e139b1b669d97ff4beb4ece116291bf698f429d47d9fccde7bd87110dd37c3711b9cf7f554b55fa90
SSDEEP

3072:P9iUoxnqKHgG6v0Jx52b3ueK5ciepMjbsF6FXqxSZGOpqnhdebZkSY64xHs5irhO:Kx+/vJb3ztieKjAmXqi5qGkyEHs5iY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1800	BsradioVisualEffect.exe
1800	BsradioVisualEffect.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TMP4352$.TMP	BsradioVisualEffect.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\TMP4352$.TMP	BsradioVisualEffect.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\SET1A83.tmp	BsradioVisualEffect.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\SET1A83.tmp	BsradioVisualEffect.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\Pulsing.dll	BsradioVisualEffect.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	BsradioVisualEffect.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\ = "IPulsingColors"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\FLAGS\ = "0"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\HELPDIR	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\TypeLib	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\ProxyStubClsid32	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}\ = "PulsingColors Class"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\ = "PulsingColors 1.0 Type Library"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\FLAGS	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}\InprocServer32\ThreadingModel = "Apartment"	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\Pulsing.dll"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\ProxyStubClsid32	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\TypeLib	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\TypeLib\Version = "1.0"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}\InprocServer32	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\TypeLib\Version = "1.0"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\0\win32	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\"	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\TypeLib\ = "{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}\TypeLib	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\0	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}\1.0\0\win32\ = "C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\Pulsing.dll"	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\ = "IPulsingColors"	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}\TypeLib\ = "{EFA4BFC3-46BA-11D4-A8AF-00105AC582C2}"	BsradioVisualEffect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFA4BFC2-46BA-11D4-A8AF-00105AC582C2}	BsradioVisualEffect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFA4BFC4-46BA-11d4-A8AF-00105AC582C2}\TypeLib\ = "{EFA4BFC3-46BA-11d4-A8AF-00105AC582C2}"	BsradioVisualEffect.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe
Token: SeRestorePrivilege	1800	BsradioVisualEffect.exe

C:\Users\Admin\AppData\Local\Temp\泽华音乐\data\User\system32\BsradioVisualEffect.exe
"C:\Users\Admin\AppData\Local\Temp\泽华音乐\data\User\system32\BsradioVisualEffect.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pulsing.dll

Filesize
152KB

MD5
a576eb80b5ec60ad3ef959b0a11ff208

SHA1
78016583b56193c788dfe5d7cea376f807c3b181

SHA256
f81486832e81ec32987ace655573fed5a0a8aa1633f84b3539810e768ab67503

SHA512
b7c9cafeca80ca463b75bf7900ae769f0258cc3720904984a0dfab478366e66254138019f529a5161f86ddfea30f63168ccec474fc24c8fe276324a8008958a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pulsing.inf

Filesize
1KB

MD5
f6d31cae67d2f620f64196f6cf3f4ae4

SHA1
523731b5dd0b4ce9a4062283088e36058d21b006

SHA256
1e0d51805cc1ce46c7ffdebd07f20acebfb31fd5be1cbfd2d75c80f2b282ccd4

SHA512
1f1facdf2350fe2d2a8a7ff3976dbf3e398c7fec56fa438706f1e8637e71de7dac482ffb9d484d13e0a0b41cc41d89b270f038bff87d998ad6d21c3ab774e908

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
86KB

MD5
54f569bd28ec57436308801f20fe7412

SHA1
277ecf633e89a58b4f80acdbde32ad3a00043f64

SHA256
ce53ab4459c64dad4e12a796d3a55848d37afa31526407f9ca5704866958100d

SHA512
0963fb9fd90ba704499a766aed8dc5ab0fc32297b33dd7ddf3099199230674f68eed51ef9e09a05bfcb2d348791afb45b8c024ee102d98740847ab0896b8a731

Download Submit