Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/09/2026, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
序列号生成器.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 序列号生成器.exe
- Size 410KB
- Sample260903-wx7pysshqd
- SHA256 9390693113d75df437a4b0aa2f2c6bda74a7af63302b66106255c72a94187efb
- MD5 ef62603a3e7a8dd4f2925a5b199f9b36
- SHA1 77dc0ba7ed21c695ab12bff86b83af20159545cd
- SHA512 ef6cea9e21de87a085a2534276340d948f531ac9d76315cebf1a09ade31744b2723bc5c461d54d4be602785725238b8e4e953a775b2b65ab7ff9d176453721c5
- SSDEEP 12288:X5OK7LKqamZloJpp94d31qAn6fOtZvALt76xX:XI8LJaUoJPad7tZvALw
- TLSH T122940215BB86C4B6D881093068AE7777E07CF7367B90B193EF071EE51DF48E1A40686A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation 序列号生成器.exe - Executes dropped EXE 3 IoCs
pid Process 1428 Crypter.exe 2492 z3492.exe 4344 z3493.exe - Loads dropped DLL 1 IoCs
pid Process 3376 regsvr32.exe -
resource yara_rule behavioral1/files/0x00070000000244ba-14.dat upx behavioral1/memory/1428-26-0x0000000000400000-0x0000000000419000-memory.dmp upx - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Crypter.exe 序列号生成器.exe File created C:\Windows\z3492.exe 序列号生成器.exe File created C:\Windows\序列号生成器.exe 序列号生成器.exe File created C:\Windows\z3493.exe 序列号生成器.exe File created C:\Windows\Net.ann 序列号生成器.exe File opened for modification C:\Windows\Net.ann 序列号生成器.exe File opened for modification C:\Windows\Crypter.exe 序列号生成器.exe File opened for modification C:\Windows\z3492.exe 序列号生成器.exe File opened for modification C:\Windows\序列号生成器.exe 序列号生成器.exe File opened for modification C:\Windows\z3493.exe 序列号生成器.exe File created C:\Windows\__tmp_rar_sfx_access_check_240654281 序列号生成器.exe File created C:\Windows\CaptchaOCR.dll 序列号生成器.exe File opened for modification C:\Windows\CaptchaOCR.dll 序列号生成器.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 612 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z3492.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z3493.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 序列号生成器.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crypter.exe - Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha\Clsid\ = "{A3AAA875-178A-4A8D-9647-536D3D7C490B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\ = "Captcha" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\HELPDIR\ = "C:\\Windows" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\ProgID\ = "Captcha.clsCaptcha" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\ = "Captcha.clsCaptcha" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\InprocServer32\ = "C:\\Windows\\CaptchaOCR.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\VERSION\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ = "clsCaptcha" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ = "_clsCaptcha" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\TypeLib\ = "{00C4842B-1600-4812-B6C0-0F0965270A69}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\0\win32\ = "C:\\Windows\\CaptchaOCR.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\ = "{00C4842B-1600-4812-B6C0-0F0965270A69}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\ = "{00C4842B-1600-4812-B6C0-0F0965270A69}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ = "_clsCaptcha" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha\ = "Captcha.clsCaptcha" regsvr32.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2492 z3492.exe 4344 z3493.exe 4344 z3493.exe 4344 z3493.exe 2492 z3492.exe 2492 z3492.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1428 1096 序列号生成器.exe 93 PID 1428 wrote to memory of 612 1428 Crypter.exe 94 PID 1096 wrote to memory of 2492 1096 序列号生成器.exe 96 PID 1096 wrote to memory of 4344 1096 序列号生成器.exe 97 PID 612 wrote to memory of 3376 612 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\序列号生成器.exe"C:\Users\Admin\AppData\Local\Temp\序列号生成器.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\Crypter.exe"C:\windows\Crypter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\reg.bat""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s CaptchaOCR.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3376
-
-
-
-
C:\windows\z3492.exe"C:\windows\z3492.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
C:\windows\z3493.exe"C:\windows\z3493.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4344
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\reg.bat
- Size 267B
- SHA256 16192fd72e214ce1f1480be04ca781d4265d388bb999c6dfd8795ac605cda137
- MD5 b17e5b57ad075030934b922a8bb6d375
- SHA1 9c7d1259f34b28745e4facd34b2ee2e468c5b22c
- SHA512 2ff6ef1db286af486957e1518e1b09319f2ccb7e669ee1e4baa1cff28affd6aefdf0bad42b32cea13aa406334fbfaf545f718094cf0cda6bceaf19381260985e
- TLSH T18CD05E199DC7E1A00E8EF45379F3E84BD5318881BC53AC2E6217AD4D9D100460BDEB53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CaptchaOCR.dll
- Size 36KB
- SHA256 ac70849d0fb3b174a3655ab4c314156d6e56459740a9e8d5ef7fd85855675bcc
- MD5 822fc33ab14f8b68037ef72eb6339fe6
- SHA1 83c3af9ec7e16aff3081d2638368873ac9255413
- SHA512 7b602bd711a920546e04acd4269d1f68396ef2c0e8506297259f5274661f8c7e38f48c29753d9cac3ccecb831694924b33948296fa52d2ea8155b941822a750e
- SSDEEP 768:DhJUMDsBZHTMOHLB/qb3VyjBPSVFcbXJe:DhJUMDsBZHLLB/qbsjYbmX
- TLSH T125F2F622B3DFC5AEE68A05310D5782ED00287E136F90C51F76CAF75C1E35A45A932B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Crypter.exe
- Size 19KB
- SHA256 9866e154c889a90ea795495af42ce728d7aac960269b72ec496b2cfef761a00f
- MD5 c2fe3d4be9e1dc2884cb45e598d5ccea
- SHA1 e3b48ebcc23c93c93d6f02576bd40933474bbbfb
- SHA512 3e97f47491ed897079ace64f96fafaac55cbf4b68e72dda65b7c4efdd3b445920944c5546f5427fe1abecd83aee390ca2cd98d7a38d5839707a82f70f0994d0f
- SSDEEP 384:48sEe22Qpd/n22Ku+oL3/GKHkJyfdRIjvr5aZRipQeELwe9:VsExfpdfBKaj2qIjzAgpzxe
- TLSH T11792DF52C514C834C70E9477919FC7E422A6C189628193C71F3EAB5BBE83D2C8E03A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\z3492.exe
- Size 48KB
- SHA256 22833164b693f4485ffd734c35495c211ae218ab08d30a0964c29a1c31964be8
- MD5 9b8a48903917a8c6cbd03ac84b950eb5
- SHA1 ddf91a716481a58cdeaaa3434a953968762439d4
- SHA512 2984a290d54445992339ff2f842ca1f14fa1ac0267e1bac47f81aa27dd5f2a70a44d19b229b51effcffac7d55a2a011c2e7e42113d14e42406db7ad47f74588e
- SSDEEP 384:5BD2FxgS/g+XkHd6rEXeQE4l1Bu1O9KKvAtvqMiii/i5iGuHSv6Ai30xogQpID+y:/2cI8A4M/cajUszqpIRaxZzMTOa0s0
- TLSH T1AE23C527FB1C5426F25681B11932AAB6782A7D305044EE0BB746FF1C2D71A43B9F472B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\z3493.exe
- Size 48KB
- SHA256 85aa46dc43c765eacef88fb44c3008297ca506b44d7e26eb622003d7e3073666
- MD5 c39f957a8df9bec59dae2d29b440a9b6
- SHA1 b64289ad876d5a2310288e6de22e6126bba46a6a
- SHA512 8b37618c407f1801a2db81ee4e9a13d4f06070a5b22e74f60d5d27dffde3412882d1238f653185d2935f713332ae4175eda5def92599c4506a6e5ee5f7dc018d
- SSDEEP 384:KDWt2EgS/g+XkHd6rEXeQE4l1Bu1O9KKvAtvqMiii/i5iGuHSv6Ai30xogQpID+B:ftUI8A4M/cajUszqpIRaxZzMTOa0s4
- TLSH T11623C427FA1C5426F25681B11932AAB6782B7D305044EE0BB746FF1C2D71A43B9F472B
- MD5 SHA1 SHA512 SSDEEP TLSH