Overview
overview
7Static
static
7AutoIt.exe
windows7-x64
3AutoIt.exe
windows10-2004-x64
3AutoUpdate.exe
windows7-x64
3AutoUpdate.exe
windows10-2004-x64
3Data/新云软件.url
windows7-x64
1Data/新云软件.url
windows10-2004-x64
1Dll/GSGFDISK.sys
windows7-x64
1Dll/GSGFDISK.sys
windows10-2004-x64
1Dll/ImgDisk.exe
windows7-x64
6Dll/ImgDisk.exe
windows10-2004-x64
6Dll/MSCOMCTL.dll
windows7-x64
3Dll/MSCOMCTL.dll
windows10-2004-x64
3Dll/MSINET.dll
windows7-x64
3Dll/MSINET.dll
windows10-2004-x64
3Dll/MSWINSCK.dll
windows7-x64
3Dll/MSWINSCK.dll
windows10-2004-x64
3Dll/MT32.dll
windows7-x64
3Dll/MT32.dll
windows10-2004-x64
3Dll/NTS.dll
windows7-x64
3Dll/NTS.dll
windows10-2004-x64
3Dll/RICHTX32.dll
windows7-x64
3Dll/RICHTX32.dll
windows10-2004-x64
3Dll/RNDINTER.dll
windows7-x64
3Dll/RNDINTER.dll
windows10-2004-x64
3Dll/Rich.exe
windows7-x64
3Dll/Rich.exe
windows10-2004-x64
3Dll/Unlocker.exe
windows7-x64
3Dll/Unlocker.exe
windows10-2004-x64
3Dll/Unlock...r5.sys
windows7-x64
1Dll/Unlock...r5.sys
windows10-2004-x64
1Dll/msado15.dll
windows7-x64
3Dll/msado15.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 05:38
Behavioral task
behavioral1
Sample
AutoIt.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
AutoIt.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
AutoUpdate.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
AutoUpdate.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Data/新云软件.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Data/新云软件.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Dll/GSGFDISK.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Dll/GSGFDISK.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Dll/ImgDisk.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral10
Sample
Dll/ImgDisk.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Dll/MSCOMCTL.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Dll/MSCOMCTL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Dll/MSINET.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Dll/MSINET.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Dll/MSWINSCK.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Dll/MSWINSCK.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Dll/MT32.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
Dll/MT32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Dll/NTS.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
Dll/NTS.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Dll/RICHTX32.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Dll/RICHTX32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Dll/RNDINTER.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Dll/RNDINTER.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Dll/Rich.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Dll/Rich.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Dll/Unlocker.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Dll/Unlocker.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Dll/UnlockerDriver5.sys
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
Dll/UnlockerDriver5.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Dll/msado15.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Dll/msado15.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Dll/NTS.dll
-
Size
33KB
-
MD5
fae8aafc5af74e012343ab1d6c5abef9
-
SHA1
fc2608d156fc738d4ef2aab92b6547416e08a8e6
-
SHA256
0fd183406280b99a292eb78f4a6cbc70f704dd7094ec2c32f30f1769781d6221
-
SHA512
775a2b3bd47e930bab5615d9633df5e81945405ae778b88da077c971928a568cd3269b9f00138f42be6e6b3a41f8dc34dd31f203924acee06085c10e64a0b6d6
-
SSDEEP
384:zDYEKIE5M7eSzzKC5JLELfD4bC03PlocplocJl2guK/AWje1CX7sOeBS3OklxRNr:fYta9zRlyM203yPGhV/NNsGllxc5ZH
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\ = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\ProgID\ = "NTService.Control.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\MiscStatus\1\ = "199824" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ = "_DNtSvc" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\NTS.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\ = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NTService.Control.1\CLSID\ = "{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ = "_DNtSvcEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NTService.Control.1\ = "NT Service Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\ = "Microsoft NT Service Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NTService.Control.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ = "_DNtSvcEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ = "_DNtSvc" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\ = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\ = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\NTS.dll, 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\ = "NT Service Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\NTS.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\ = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NTService.Control.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}\Control\ regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30 PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30 PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30 PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30 PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30 PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30 PID 2884 wrote to memory of 2944 2884 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Dll\NTS.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Dll\NTS.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2944
-