Overview
overview
7Static
static
71a2bedd154...18.exe
windows7-x64
71a2bedd154...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ps.dll
windows7-x64
3$PLUGINSDI...ps.dll
windows10-2004-x64
3$PLUGINSDI...rl.dll
windows7-x64
3$PLUGINSDI...rl.dll
windows10-2004-x64
3Baidu-TB-ASBar.exe
windows7-x64
7Baidu-TB-ASBar.exe
windows10-2004-x64
1$PROGRAM_F...er.exe
windows7-x64
1$PROGRAM_F...er.exe
windows10-2004-x64
1$PROGRAM_F...ar.dll
windows7-x64
7$PROGRAM_F...ar.dll
windows10-2004-x64
7$PROGRAM_F...rX.dll
windows7-x64
7$PROGRAM_F...rX.dll
windows10-2004-x64
7$PROGRAM_F...er.exe
windows7-x64
1$PROGRAM_F...er.exe
windows10-2004-x64
1$PROGRAM_F...rc.dll
windows7-x64
1$PROGRAM_F...rc.dll
windows10-2004-x64
1Data/Games/GAME.htm
windows7-x64
1Data/Games/GAME.htm
windows10-2004-x64
1Data/Nav1/DH1.htm
windows7-x64
1Data/Nav1/DH1.htm
windows10-2004-x64
1Data/Nav1/DH2.htm
windows7-x64
1Data/Nav1/DH2.htm
windows10-2004-x64
1Data/Nav1/DH3.htm
windows7-x64
1Data/Nav1/DH3.htm
windows10-2004-x64
1Data/Nav1/DH4.htm
windows7-x64
1Data/Nav1/DH4.htm
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 12:46
Behavioral task
behavioral1
Sample
1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ToolTips.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ToolTips.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WebCtrl.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WebCtrl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Baidu-TB-ASBar.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Baidu-TB-ASBar.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PROGRAM_FILES/Baidu/ASBarBroker.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
$PROGRAM_FILES/Baidu/ASBarBroker.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PROGRAM_FILES/Baidu/AddressBar.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
$PROGRAM_FILES/Baidu/AddressBar.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Data/Games/GAME.htm
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Data/Games/GAME.htm
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Data/Nav1/DH1.htm
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
Data/Nav1/DH1.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Data/Nav1/DH2.htm
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
Data/Nav1/DH2.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Data/Nav1/DH3.htm
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
Data/Nav1/DH3.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Data/Nav1/DH4.htm
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Data/Nav1/DH4.htm
Resource
win10v2004-20240611-en
General
-
Target
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
-
Size
2.6MB
-
MD5
ba75680a2b710f7d2c575e816000f041
-
SHA1
a36e8bf8635473494cf58953227b21facdfd2682
-
SHA256
4c4c9cf71e8eb6f83fe875ad657512f1405648b30472df6597d92a679ee51801
-
SHA512
4408149541ab4b6eda6c9d6b95995be64773559701a18096c283e503fa3b5b22b624db5956c7916f4cecd80c47036e13b100dd51069ef23292749ef4a89bfbb3
-
SSDEEP
49152:FzO0nB7oATGdgMlFp6VnvxkSJGsar6KX6n1OGyWdSmuzBG4fi8p4VdsvhwRhXI8u:FzOCdooGdgMlFcVnvxkSJGsar6a61OG8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
BarBroker.exepid process 2596 BarBroker.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exepid process 268 regsvr32.exe 268 regsvr32.exe 268 regsvr32.exe 268 regsvr32.exe 268 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\NoExplorer = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\id = "bdbar" regsvr32.exe -
Drops file in Program Files directory 4 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dll regsvr32.exe File created C:\Program Files (x86)\Baidu\Toolbar\rc.dll regsvr32.exe File created C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe regsvr32.exe File created C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dll regsvr32.exe -
Processes:
BarBroker.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2} BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\AppName = "BarBroker.exe" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\AppPath = "%ProgramFiles(x86)%\\Baidu\\Toolbar" BarBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\Policy = "3" BarBroker.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = "12" regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
BarBroker.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\TypeLib BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\TypeLib\ = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BarBroker.EXE\AppID = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\ = "BarBroker" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CurVer\ = "BaiduBar.Tool.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BarBroker.BDBroker.1\CLSID BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand.1\CLSID\ = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\VersionIndependentProgID\ = "BarBroker.BDBroker" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\ = "°Ù¶È¹¤¾ßÀ¸¸¨Öú¶ÔÏó" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\ProgID\ = "BaiduBarX.BandIE.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.5\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.5\CLSID\ = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.1\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\VersionIndependentProgID\ = "BaiduBarEx.BDHomePage" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2} BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\ = "°Ù¶È¹¤¾ßÀ¸" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BarBroker.BDBroker.1 BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\0\win32\ = "C:\\Program Files (x86)\\Baidu\\Toolbar\\BarBroker.exe" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CLSID\ = "{A7F05EE4-0426-454F-8013-C41E3596E9E9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0\HELPDIR\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\TypeLib\Version = "1.0" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\ProgID\ = "BaiduBarX.ToolBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib\ = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172} BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\TypeLib\ = "{3A8C9D89-3271-45F4-98C0-56B0F5A16172}" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib\ = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.5\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0\0\win32\ = "C:\\Program Files (x86)\\Baidu\\Toolbar\\BaiduBarX.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BarBroker.BDBroker\CLSID\ = "{5BECD27B-DCF5-4DEF-B066-486A47245C03}" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.3 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\FLAGS\ = "0" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\ProgID BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\ProgID\ = "BaiduBarEx.BDHomePage.5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\ = "°Ù¶È¹¤¾ßÀ¸¸¨Öú¶ÔÏó" regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 268 2372 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 2596 268 regsvr32.exe BarBroker.exe PID 268 wrote to memory of 2596 268 regsvr32.exe BarBroker.exe PID 268 wrote to memory of 2596 268 regsvr32.exe BarBroker.exe PID 268 wrote to memory of 2596 268 regsvr32.exe BarBroker.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe"C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe" -RegServer3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dllFilesize
2.6MB
MD5ba75680a2b710f7d2c575e816000f041
SHA1a36e8bf8635473494cf58953227b21facdfd2682
SHA2564c4c9cf71e8eb6f83fe875ad657512f1405648b30472df6597d92a679ee51801
SHA5124408149541ab4b6eda6c9d6b95995be64773559701a18096c283e503fa3b5b22b624db5956c7916f4cecd80c47036e13b100dd51069ef23292749ef4a89bfbb3
-
\Program Files (x86)\Baidu\Toolbar\BarBroker.exeFilesize
228KB
MD5adafb685914e48bcb2cc47d02de967d4
SHA1241e39b0b51028ab451f0abb2e39492ce18e2701
SHA2562a5e0c7f3698b8192df5ca2548944632e656eb27f4b3b3bd252b370b7348ad70
SHA5128f01feebc063c0b611c7503f1bbcbd5479fb65f0acc8c66eae91965228c5c8037bafc3393b251d77f2f62d457d2e661b99d703bebac7df269792f030258388ed
-
\Program Files (x86)\Baidu\Toolbar\rc.dllFilesize
468KB
MD5fd00f62dcb903fbbbe40aeb48a482708
SHA11333d5ef06dfd707e40a1322cb40c08487b3f50d
SHA2563efdb3bf488038cf8c08b690f4bfa469fb49b9d2ed585ba3c88feb0770f37350
SHA512c83ac2be93e05527e09de4ea0b3617bbcbb5747890c7a0b861ad3b55aaaec3d148783a7fcbbacb66b92ede37440d82d41fbfe8a871273f1c6796fdcbe63131a2
-
memory/268-2-0x0000000002810000-0x0000000002AA8000-memory.dmpFilesize
2.6MB
-
memory/268-9-0x0000000002BB0000-0x0000000002C25000-memory.dmpFilesize
468KB