9390693113d75df437a4b0aa2f2c6bda74a7af63302b66106255c72a94187efb

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
序列号生成器.exe
Size 410KB
Sample260903-wx7pysshqd
SHA256 9390693113d75df437a4b0aa2f2c6bda74a7af63302b66106255c72a94187efb
MD5 ef62603a3e7a8dd4f2925a5b199f9b36
SHA1 77dc0ba7ed21c695ab12bff86b83af20159545cd
SHA512 ef6cea9e21de87a085a2534276340d948f531ac9d76315cebf1a09ade31744b2723bc5c461d54d4be602785725238b8e4e953a775b2b65ab7ff9d176453721c5
SSDEEP 12288:X5OK7LKqamZloJpp94d31qAn6fOtZvALt76xX:XI8LJaUoJPad7tZvALw
TLSH
T122940215BB86C4B6D881093068AE7777E07CF7367B90B193EF071EE51DF48E1A40686A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1768	Crypter.exe
4984	z3492.exe
2728	z3493.exe

Loads dropped DLL 1 IoCs

pid	Process
4760	regsvr32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5a9-14.dat	upx
behavioral2/memory/1768-24-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/1768-49-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\z3492.exe	序列号生成器.exe
File created	C:\Windows\序列号生成器.exe	序列号生成器.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240727921	序列号生成器.exe
File created	C:\Windows\z3492.exe	序列号生成器.exe
File opened for modification	C:\Windows\序列号生成器.exe	序列号生成器.exe
File created	C:\Windows\z3493.exe	序列号生成器.exe
File opened for modification	C:\Windows\z3493.exe	序列号生成器.exe
File created	C:\Windows\Net.ann	序列号生成器.exe
File opened for modification	C:\Windows\Net.ann	序列号生成器.exe
File created	C:\Windows\CaptchaOCR.dll	序列号生成器.exe
File opened for modification	C:\Windows\CaptchaOCR.dll	序列号生成器.exe
File created	C:\Windows\Crypter.exe	序列号生成器.exe
File opened for modification	C:\Windows\Crypter.exe	序列号生成器.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z3492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z3493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	序列号生成器.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\ = "Captcha"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\ProgID\ = "Captcha.clsCaptcha"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\0\win32\ = "C:\\Windows\\CaptchaOCR.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\HELPDIR\ = "C:\\Windows"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\TypeLib\ = "{00C4842B-1600-4812-B6C0-0F0965270A69}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ = "_clsCaptcha"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ = "_clsCaptcha"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha\ = "Captcha.clsCaptcha"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\ = "Captcha.clsCaptcha"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha\Clsid\ = "{A3AAA875-178A-4A8D-9647-536D3D7C490B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ = "clsCaptcha"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\ = "{00C4842B-1600-4812-B6C0-0F0965270A69}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AAA875-178A-4A8D-9647-536D3D7C490B}\InprocServer32\ = "C:\\Windows\\CaptchaOCR.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00C4842B-1600-4812-B6C0-0F0965270A69}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\TypeLib\ = "{00C4842B-1600-4812-B6C0-0F0965270A69}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFA48CE3-1284-44AB-A1DD-1080111FA2D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Captcha.clsCaptcha\Clsid	regsvr32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	z3493.exe
4984	z3492.exe
4984	z3492.exe
4984	z3492.exe
2728	z3493.exe
2728	z3493.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1768	4924	序列号生成器.exe	89
PID 4924 wrote to memory of 4984	4924	序列号生成器.exe	90
PID 1768 wrote to memory of 3080	1768	Crypter.exe	91
PID 4924 wrote to memory of 2728	4924	序列号生成器.exe	92
PID 3080 wrote to memory of 4760	3080	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\序列号生成器.exe
"C:\Users\Admin\AppData\Local\Temp\序列号生成器.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\windows\Crypter.exe
  "C:\windows\Crypter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\reg.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s CaptchaOCR.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4760
- C:\windows\z3492.exe
  "C:\windows\z3492.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4984
- C:\windows\z3493.exe
  "C:\windows\z3493.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reg.bat

Path C:\Users\Admin\AppData\Local\Temp\reg.bat
Size 267B
SHA256 16192fd72e214ce1f1480be04ca781d4265d388bb999c6dfd8795ac605cda137
MD5 b17e5b57ad075030934b922a8bb6d375
SHA1 9c7d1259f34b28745e4facd34b2ee2e468c5b22c
SHA512 2ff6ef1db286af486957e1518e1b09319f2ccb7e669ee1e4baa1cff28affd6aefdf0bad42b32cea13aa406334fbfaf545f718094cf0cda6bceaf19381260985e
TLSH
T18CD05E199DC7E1A00E8EF45379F3E84BD5318881BC53AC2E6217AD4D9D100460BDEB53
MD5 SHA1 SHA512 TLSH

Submit Download

CaptchaOCR.dll

Path C:\Windows\CaptchaOCR.dll
Size 36KB
SHA256 ac70849d0fb3b174a3655ab4c314156d6e56459740a9e8d5ef7fd85855675bcc
MD5 822fc33ab14f8b68037ef72eb6339fe6
SHA1 83c3af9ec7e16aff3081d2638368873ac9255413
SHA512 7b602bd711a920546e04acd4269d1f68396ef2c0e8506297259f5274661f8c7e38f48c29753d9cac3ccecb831694924b33948296fa52d2ea8155b941822a750e
SSDEEP 768:DhJUMDsBZHTMOHLB/qb3VyjBPSVFcbXJe:DhJUMDsBZHLLB/qbsjYbmX
TLSH
T125F2F622B3DFC5AEE68A05310D5782ED00287E136F90C51F76CAF75C1E35A45A932B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crypter.exe

Path C:\Windows\Crypter.exe
Size 19KB
SHA256 9866e154c889a90ea795495af42ce728d7aac960269b72ec496b2cfef761a00f
MD5 c2fe3d4be9e1dc2884cb45e598d5ccea
SHA1 e3b48ebcc23c93c93d6f02576bd40933474bbbfb
SHA512 3e97f47491ed897079ace64f96fafaac55cbf4b68e72dda65b7c4efdd3b445920944c5546f5427fe1abecd83aee390ca2cd98d7a38d5839707a82f70f0994d0f
SSDEEP 384:48sEe22Qpd/n22Ku+oL3/GKHkJyfdRIjvr5aZRipQeELwe9:VsExfpdfBKaj2qIjzAgpzxe
TLSH
T11792DF52C514C834C70E9477919FC7E422A6C189628193C71F3EAB5BBE83D2C8E03A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z3492.exe

Path C:\Windows\z3492.exe
Size 48KB
SHA256 22833164b693f4485ffd734c35495c211ae218ab08d30a0964c29a1c31964be8
MD5 9b8a48903917a8c6cbd03ac84b950eb5
SHA1 ddf91a716481a58cdeaaa3434a953968762439d4
SHA512 2984a290d54445992339ff2f842ca1f14fa1ac0267e1bac47f81aa27dd5f2a70a44d19b229b51effcffac7d55a2a011c2e7e42113d14e42406db7ad47f74588e
SSDEEP 384:5BD2FxgS/g+XkHd6rEXeQE4l1Bu1O9KKvAtvqMiii/i5iGuHSv6Ai30xogQpID+y:/2cI8A4M/cajUszqpIRaxZzMTOa0s0
TLSH
T1AE23C527FB1C5426F25681B11932AAB6782A7D305044EE0BB746FF1C2D71A43B9F472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z3493.exe

Path C:\Windows\z3493.exe
Size 48KB
SHA256 85aa46dc43c765eacef88fb44c3008297ca506b44d7e26eb622003d7e3073666
MD5 c39f957a8df9bec59dae2d29b440a9b6
SHA1 b64289ad876d5a2310288e6de22e6126bba46a6a
SHA512 8b37618c407f1801a2db81ee4e9a13d4f06070a5b22e74f60d5d27dffde3412882d1238f653185d2935f713332ae4175eda5def92599c4506a6e5ee5f7dc018d
SSDEEP 384:KDWt2EgS/g+XkHd6rEXeQE4l1Bu1O9KKvAtvqMiii/i5iGuHSv6Ai30xogQpID+B:ftUI8A4M/cajUszqpIRaxZzMTOa0s4
TLSH
T11623C427FA1C5426F25681B11932AAB6782B7D305044EE0BB746FF1C2D71A43B9F472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-24-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1768-49-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4924-42-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads