Analysis

  • max time kernel
    6s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2025, 10:18

General

  • Target

    AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AutoPerfProxy.dll

  • Size

    113KB

  • MD5

    1c05e4d0473097edbd10fbe6b15fd4d2

  • SHA1

    bdcb0a4d78fb43224815a32362857888ead36f38

  • SHA256

    59b912a4e8b316cbb08132a706d4783da3a6e5d4bdd91bc34cc9fbf1143e4f67

  • SHA512

    961b5377f5f5e9d5ed69b64e3a4a48bcdb29a389572f7245e00b95df589d48c84f48078dac7fda0fce29216e4e5809bca36d8c156e0511a3a2d7d23b2f137010

  • SSDEEP

    3072:4N6UcIaXsy1Ulx6w2PNRDAmQKeXyrwrw2OgYNSVZyB6A:rI012IMbKNw5OgYNrB6A

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 36 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AliIM2013_7.21.04C去广告绿色优化版V2\AliWangWang\7.21.04C\AutoPerfProxy.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\AliIM2013_7.21.04C去广告绿色优化版V2\AliWangWang\7.21.04C\AutoPerfProxy.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads