Overview
overview
10Static
static
10852b1c6688...18.exe
windows7-x64
10852b1c6688...18.exe
windows10-2004-x64
10$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...lp.dll
windows7-x64
3$PLUGINSDI...lp.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/pin.vbs
windows7-x64
1$TEMP/pin.vbs
windows10-2004-x64
1CSMX.dll
windows7-x64
3CSMX.dll
windows10-2004-x64
3Esdll.dll
windows7-x64
3Esdll.dll
windows10-2004-x64
3IVMSource.dll
windows7-x64
5IVMSource.dll
windows10-2004-x64
5OpenCandy/...lp.dll
windows7-x64
3OpenCandy/...lp.dll
windows10-2004-x64
7PmpSplitter.dll
windows7-x64
3PmpSplitter.dll
windows10-2004-x64
3RadGtSplitter.dll
windows7-x64
3RadGtSplitter.dll
windows10-2004-x64
3binkw32.dll
windows7-x64
3binkw32.dll
windows10-2004-x64
3csfcodec/ijl15.dll
windows7-x64
3csfcodec/ijl15.dll
windows10-2004-x64
3csfcodec/m...tu.dll
windows7-x64
3csfcodec/m...tu.dll
windows10-2004-x64
3csfcodec/m...cu.dll
windows7-x64
3csfcodec/m...cu.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2024 11:18
Behavioral task
behavioral1
Sample
852b1c668870b9e64ac7c23d5d75ee9e_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
852b1c668870b9e64ac7c23d5d75ee9e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$TEMP/pin.vbs
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
$TEMP/pin.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
CSMX.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
CSMX.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Esdll.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Esdll.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
IVMSource.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
IVMSource.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
OpenCandy/OCSetupHlp.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
OpenCandy/OCSetupHlp.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
PmpSplitter.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
PmpSplitter.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
RadGtSplitter.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
RadGtSplitter.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
binkw32.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
binkw32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
csfcodec/ijl15.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral28
Sample
csfcodec/ijl15.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
csfcodec/mpc_mcucltu.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
csfcodec/mpc_mcucltu.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
csfcodec/mpc_mcufilecu.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
csfcodec/mpc_mcufilecu.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
csfcodec/mpc_mcufilecu.dll
-
Size
92KB
-
MD5
ebc40e6239ac8f4f540707ee091dd30b
-
SHA1
2f830b951a68ce9700ef7a47fa2d3be9db285643
-
SHA256
2e551151c3fc7dc88a462f46bad62d8e2022ab6a7b3250da0eaa1d1bad81e1f3
-
SHA512
891016940c2ba93fde6b78101c661dd70534c462183da6776873d8b08351431e76d60ab70b84d82e11b98ec6d7e5c6f8b25c421408187331b4346ef85c0dd351
-
SSDEEP
1536:BRXoPAI/8ETdo2vH31ihB8uu8HCLOUXw5XZkwQwuFnsFjFUJipl6hh/llE+De:XXnI/8ETdtvHliLDcLw5aeXUJipl6D/e
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\VersionIndependentProgID\ = "Collegesoft.McuUploadClient.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient\ = "Collegesoft McuDownloadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\ProgID\ = "Collegesoft.McuDownloadClient" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\ = "Collegesoft McuFileManagerClient" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\TypeLib\ = "{BAC04407-3588-42AA-93BE-6D3720E9FB28}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient.1\ = "Collegesoft McuDownloadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient.1\CurVer\ = "Collegesoft.McuDownloadClient" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient.1\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient\ = "Collegesoft McuFileManagerClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\TypeLib\ = "{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient.1\CurVer\ = "Collegesoft.McuUploadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\ProgID\ = "Collegesoft.McuFileManagerClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient.1\CLSID\ = "{46E00789-37CA-4278-8907-02088898B6B0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient.1\ = "Collegesoft McuUploadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\TypeLib\ = "{46E00789-37CA-4278-8907-02088898B6B0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient.1\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\ = "Collegesoft McuDownloadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\VersionIndependentProgID\ = "Collegesoft.McuFileManagerClient.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csfcodec\\mpc_mcufilecu.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient\CLSID\ = "{46E00789-37CA-4278-8907-02088898B6B0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient.1\ = "Collegesoft McuFileManagerClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient.1\CLSID\ = "{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient\CLSID\ = "{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\VersionIndependentProgID\ = "Collegesoft.McuDownloadClient.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\ = "Collegesoft McuUploadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\ProgID\ = "Collegesoft.McuUploadClient" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csfcodec\\mpc_mcufilecu.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient.1\CLSID\ = "{BAC04407-3588-42AA-93BE-6D3720E9FB28}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient\CLSID\ = "{BAC04407-3588-42AA-93BE-6D3720E9FB28}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csfcodec\\mpc_mcufilecu.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuDownloadClient.1\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient\ = "Collegesoft McuUploadClient" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC04407-3588-42AA-93BE-6D3720E9FB28}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46E00789-37CA-4278-8907-02088898B6B0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuUploadClient.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Collegesoft.McuFileManagerClient.1\CurVer\ = "Collegesoft.McuFileManagerClient" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C56B154-43F7-48A0-87B2-E9ACC8E1E471} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3972 wrote to memory of 772 3972 regsvr32.exe 87 PID 3972 wrote to memory of 772 3972 regsvr32.exe 87 PID 3972 wrote to memory of 772 3972 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\csfcodec\mpc_mcufilecu.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\csfcodec\mpc_mcufilecu.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:772
-