Overview
overview
3Static
static
344017993/D...lp.htm
windows7-x64
144017993/D...lp.htm
windows10-2004-x64
144017993/D....2.exe
windows7-x64
144017993/D....2.exe
windows10-2004-x64
144017993/c...ge.url
windows7-x64
144017993/c...ge.url
windows10-2004-x64
144017993/c...rd.exe
windows7-x64
144017993/c...rd.exe
windows10-2004-x64
144017993/c...32.dll
windows7-x64
144017993/c...32.dll
windows10-2004-x64
144017993/�...lp.htm
windows7-x64
144017993/�...lp.htm
windows10-2004-x64
144017993/�....2.exe
windows7-x64
144017993/�....2.exe
windows10-2004-x64
144017993/�...it.vbs
windows7-x64
144017993/�...it.vbs
windows10-2004-x64
144017993/�...pp.exe
windows7-x64
144017993/�...pp.exe
windows10-2004-x64
144017993/�...ng.vbs
windows7-x64
144017993/�...ng.vbs
windows10-2004-x64
144017993/�...in.vbs
windows7-x64
144017993/�...in.vbs
windows10-2004-x64
144017993/�...RT.exe
windows7-x64
144017993/�...RT.exe
windows10-2004-x64
144017993/�...Io.dll
windows7-x64
144017993/�...Io.dll
windows10-2004-x64
144017993/�...Io.sys
windows7-x64
144017993/�...Io.sys
windows10-2004-x64
144017993/�...ra.vbs
windows7-x64
144017993/�...ra.vbs
windows10-2004-x64
144017993/�...ps.vbs
windows7-x64
144017993/�...ps.vbs
windows10-2004-x64
1Analysis
-
max time kernel
41s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/串口调试助手V2.2.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/串口调试助手V2.2.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
44017993/comwizard/Century Soar Homepage.url
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
44017993/comwizard/Century Soar Homepage.url
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
44017993/comwizard/ComWizard.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral8
Sample
44017993/comwizard/ComWizard.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
44017993/comwizard/MSCOMM32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
44017993/comwizard/MSCOMM32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
44017993/串口调试助手V2.2/help.htm
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
44017993/串口调试助手V2.2/help.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
44017993/串口调试助手V2.2/串口调试助手V2.2.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
44017993/串口调试助手V2.2/串口调试助手V2.2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
44017993/第1章 串口编程调试精灵/Hexedit.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
44017993/第1章 串口编程调试精灵/Hexedit.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
44017993/第1章 串口编程调试精灵/SerialApp.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral18
Sample
44017993/第1章 串口编程调试精灵/SerialApp.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
44017993/第1章 串口编程调试精灵/dlgSetting.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
44017993/第1章 串口编程调试精灵/dlgSetting.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
44017993/第1章 串口编程调试精灵/frmMain.vbs
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral22
Sample
44017993/第1章 串口编程调试精灵/frmMain.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
44017993/第2章 智能安防报警系统/ALERT.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral24
Sample
44017993/第2章 智能安防报警系统/ALERT.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
44017993/第2章 智能安防报警系统/WinIo.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
44017993/第2章 智能安防报警系统/WinIo.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
44017993/第2章 智能安防报警系统/WinIo.sys
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral28
Sample
44017993/第2章 智能安防报警系统/WinIo.sys
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
44017993/第2章 智能安防报警系统/frmBufpara.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral30
Sample
44017993/第2章 智能安防报警系统/frmBufpara.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
44017993/第2章 智能安防报警系统/frmCommProps.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
44017993/第2章 智能安防报警系统/frmCommProps.vbs
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
44017993/comwizard/MSCOMM32.dll
-
Size
94KB
-
MD5
6c70cb243167b9cb7022400e02d67541
-
SHA1
fe9fc7ef8a5dfbef105c344431776a090fbd8e8c
-
SHA256
d8f4a3ef01f559dedef663b6c4d03da8894be3175e736fdec9e8fd6651a64665
-
SHA512
ecb0887b38da7e80de539e1f40cae0c76c8441ff06d423f84d937ed7de50e1e08d0ac43b650c36b51fa1499b7fb2e6916d5ea6790c3e64984813030e1acf769c
-
SSDEEP
1536:YXuy5KT+uoUML9j3ZJb0M7h6isxitRHrkDj5qJ4UGyKbGubL:YXv5KKJfh30DxAtYDYJ4UGyGTbL
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\ = "Microsoft Comm Control 5.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CurVer\ = "MSCOMMLib.MSComm.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ = "DMSCommEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ = "DMSCommEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll, 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1\ = "Microsoft Communications Control, version 5.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1\CLSID\ = "{648A5600-2C6E-101B-82B6-000000000014}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ProgID\ = "MSCOMMLib.MSComm.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ToolboxBitmap32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ = "IMSComm" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\Version = "1.1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014}\ = "MSComm General Propery Page Object" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ = "IMSComm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CLSID\ = "{648A5600-2C6E-101B-82B6-000000000014}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3652 wrote to memory of 4852 3652 regsvr32.exe 81 PID 3652 wrote to memory of 4852 3652 regsvr32.exe 81 PID 3652 wrote to memory of 4852 3652 regsvr32.exe 81