Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 06:26
Behavioral task
behavioral1
Sample
fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe
- Size 66KB
- Sample260802-g687taec86
- SHA256 fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5
- MD5 4415da2cd651dc2dac53e22a6927a48a
- SHA1 96b0a918d728a45c599dfd215e23176410c7f05f
- SHA512 55c9bfde17b657c7c8e1298309cbcb2dc6c94290883adbe811b6ec210ff0fcf235bd0b3bce46f9a9645bec8592b41bc8672c3767fa60968dcc0b2260d3750bd0
- SSDEEP 768:oXRZvh74qz+CJG00a/263KFXvYPdFfXoqmkoDrywi647fs5Fa6LOhCvWP2EhRvOW:o7pEUG00sX62PdFfHmLSu44a6YC4Zam
- TLSH T1FC63CF6F86301C40C909C936BDA2AEB655A8F3C55D1383B331BD4D95CF1628297AD3BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 6388 fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe -
resource yara_rule behavioral2/memory/6388-0-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/6388-8-0x0000000000400000-0x0000000000444000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\bcsys.exe fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe File created C:\Windows\bc.ico fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe File created C:\Windows\cb16.ico fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\06\command\ = "C:\\Windows\\bcsys.exe /gxin" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B} fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\Open\Command\ = "mshta VBScript:msgbox(\"请鼠标右键操作！\",64,\"BC系统\")(close)" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\02 fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\05 fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\05\MUIVerb = "主页" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\ = "BC系统" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\Open\Command fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\05\icon = "C:\\Windows\\system32\\shell32.dll,150" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\06 fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\02\MUIVerb = "实用工具" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\05\SeparatorBefore fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\05\command fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\ShellFolder fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\06\icon = "C:\\Windows\\system32\\shell32.dll,221" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\Open\SubCommands = "BC.A01;BC.A02;|;BC.A03;BC.A04;|;BC.A06;BC.A07;|;BC.A09;" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\Open\icon = "C:\\Windows\\system32\\shell32.dll,17" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\02\SubCommands = "BC.B01;BC.B02;BC.B04;|;BC.B05;BC.B06;|;BC.B07;BC.B08" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\DefaultIcon fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\Open fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\06\MUIVerb = "更新" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\ShellFolder\Attributes = "0" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\DefaultIcon\ = "C:\\Windows\\bc.ico" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\Open\MUIVerb = "业务系统" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\02\icon = "C:\\Windows\\system32\\shell32.dll,211" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\06\command fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\InfoTip = "鼠标右键单击" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B316D21B-3B22-B6D4-BBD3-BBD452DB3D4B}\Shell\05\command\ = "C:\\Windows\\explorer.exe http://cc.bluce.cc/bc/" fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe"C:\Users\Admin\AppData\Local\Temp\fbb83423d033925a7bf48e4ffe5e9a9cffa54849fee43e487c82395028637bd5.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsb85F0.tmp\nsDialogs.dll
- Size 9KB
- SHA256 4457d44de8613db6b5a42e218402929f32a8182446b07edb4b84e7a61926cfb3
- MD5 7bc0b624c39e9e83e0252db3bfdc34fd
- SHA1 7614a90c2960c6ec342f6d9ac614aa855b3c4857
- SHA512 dce5138a404a3e86937c6b21e2612041594c08cea26c3d36f89c2ae1479fea177c479f04e8204f5f0ce72be8bf6de4345ac4a53f442dae7653fef17e318a4073
- SSDEEP 192:uyz6hxh0ki/EoGk1GkpLplhKCdLHcMD9T:vz9/hhKCdLLD
- TLSH T1A012E65777A599F3DA8F523432563B37C374A220B0A47E07C7338A4D59261963E39312
- MD5 SHA1 SHA512 SSDEEP TLSH