zloader | 9f8cd68021a1987bcb5115056f67fbdc12d24718e51c9103c696702512d78725

Change Default File Association

T1042

Processes:

fastpdf_ext_process.exefastpdf_ext_process.exeregsvr32.exefastpdf_ext_process.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_64bit	fastpdf_ext_process.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit\ = "{221A55C1-C316-4b79-A259-0CED2417600D}"	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Thorzip	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Thorzip\ = "{E1E3163A-D2B0-4C20-A859-1B420ECB881A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_64bit\ = "{5D26A5C8-E94B-44d3-A027-9DF32468F8E7}"	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_64bit	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_64bit	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_64bit\ = "{5D26A5C8-E94B-44d3-A027-9DF32468F8E7}"	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit\ = "{221A55C1-C316-4b79-A259-0CED2417600D}"	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_64bit\ = "{5D26A5C8-E94B-44d3-A027-9DF32468F8E7}"	fastpdf_ext_process.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit\ = "{221A55C1-C316-4b79-A259-0CED2417600D}"	fastpdf_ext_process.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Downloads MZ/PE file

Executes dropped EXE 49 IoCs

Processes:

IMedia-553.exeIMediaB.exesyzs03_1000219144.exeIMediaT.exeIMediaDesk.exeIMedia.exeMarket.exeTinst.exeFastpdf_setup_ver21042017.420.1.1.1.exeleishenzip_247915520_tiangua_001.exeQMEmulatorService.exeFlashZip_2710.exefpprotect.exefastpdf_ext_process.exeSZipMd5Tool.exefastpdf_ext_process64.exeOfficeDownloaderInstall_0_100016_lanshan.exefastpdf_ext_process64.exefastpdf_ext_process.exefastpdf_ext_process64.exefastpdf_ext_process.exeSZipService.exefastpdf.execonhost.exeSZipUpdate.exeSZipMd5Tool.exeSZipMd5Tool.exeSZipTray.exeSZipTray.exeSZipTray.execef_frame_render.exeAppMarket.exesyzs_dl_svr.execef_frame_render.execef_frame_render.exeThorFileManager.exeThorReport.exeSZipMd5Tool.exeSZipMd5Tool.exeSZipMd5Tool.exek52zip20210520-220-21.exekzipservice.execef_frame_render.exefastpdf.exekzip_casual64.exekzip_main.exekrecommend.exe

pid	process
1000	IMedia-553.exe
1668	IMediaB.exe
568	syzs03_1000219144.exe
1892	IMediaT.exe
1680	IMediaDesk.exe
944	IMedia.exe
1304	Market.exe
1784	Tinst.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
1604	leishenzip_247915520_tiangua_001.exe
1296	QMEmulatorService.exe
1780	FlashZip_2710.exe
816	fpprotect.exe
1064	fastpdf_ext_process.exe
1260	SZipMd5Tool.exe
868	fastpdf_ext_process64.exe
1064	fastpdf_ext_process.exe
1664	OfficeDownloaderInstall_0_100016_lanshan.exe
1312	fastpdf_ext_process64.exe
2068	fastpdf_ext_process.exe
2164	fastpdf_ext_process64.exe
2196	fastpdf_ext_process.exe
2236	SZipService.exe
2360	fastpdf.exe
2388	conhost.exe
2432	SZipUpdate.exe
2460	SZipMd5Tool.exe
2768	SZipMd5Tool.exe
3064	SZipTray.exe
2444	SZipTray.exe
2124	SZipTray.exe
2424	cef_frame_render.exe
380	AppMarket.exe
2952	syzs_dl_svr.exe
2480	cef_frame_render.exe
520	cef_frame_render.exe
2424	cef_frame_render.exe
1692	ThorFileManager.exe
1880	ThorReport.exe
1900	SZipMd5Tool.exe
1564	SZipMd5Tool.exe
1672	SZipMd5Tool.exe
2736	k52zip20210520-220-21.exe
1776	kzipservice.exe
1976	cef_frame_render.exe
3012	fastpdf.exe
2200	kzip_casual64.exe
2660	kzip_main.exe
2740	krecommend.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

cef_frame_render.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	cef_frame_render.exe

Loads dropped DLL 64 IoCs

Processes:

789543351b1c5d10216ff9319e835a3c.exeIMedia-553.exeIMediaDesk.exeIMediaB.exeIMedia.exesyzs03_1000219144.exerundll32.exerundll32.exeMarket.exeTinst.exeFastpdf_setup_ver21042017.420.1.1.1.exeleishenzip_247915520_tiangua_001.exeQMEmulatorService.exe

pid	process
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1000	IMedia-553.exe
1000	IMedia-553.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1000	IMedia-553.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1000	IMedia-553.exe
1000	IMedia-553.exe
1680	IMediaDesk.exe
1680	IMediaDesk.exe
1668	IMediaB.exe
1668	IMediaB.exe
1000	IMedia-553.exe
944	IMedia.exe
944	IMedia.exe
568	syzs03_1000219144.exe
568	syzs03_1000219144.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
568	syzs03_1000219144.exe
1344	rundll32.exe
1344	rundll32.exe
1344	rundll32.exe
1344	rundll32.exe
1224
568	syzs03_1000219144.exe
1304	Market.exe
1304	Market.exe
568	syzs03_1000219144.exe
1784	Tinst.exe
1784	Tinst.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1996	789543351b1c5d10216ff9319e835a3c.exe
1604	leishenzip_247915520_tiangua_001.exe
1604	leishenzip_247915520_tiangua_001.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

IMedia-553.execef_frame_render.exeSZipMd5Tool.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IMedia-553.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cef_frame_render.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SZipMd5Tool.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

SZipTray.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\	SZipTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	SZipTray.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

syzs03_1000219144.exeQMEmulatorService.exeleishenzip_247915520_tiangua_001.exeAppMarket.exeThorReport.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	syzs03_1000219144.exe
File opened for modification	\??\PhysicalDrive0	QMEmulatorService.exe
File opened for modification	\??\PhysicalDrive0	leishenzip_247915520_tiangua_001.exe
File opened for modification	\??\PhysicalDrive0	AppMarket.exe
File opened for modification	\??\PhysicalDrive0	ThorReport.exe

Drops file in System32 directory 4 IoCs

Processes:

QMEmulatorService.exeSZipMd5Tool.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db	QMEmulatorService.exe
File created	C:\Windows\system32\SZipOverlayIcon.dll	SZipMd5Tool.exe
File created	C:\Windows\system32\SZipOverlayIcon64.dll	SZipMd5Tool.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db	QMEmulatorService.exe

Drops file in Program Files directory 64 IoCs

Processes:

Tinst.exeFastpdf_setup_ver21042017.420.1.1.1.exek52zip20210520-220-21.exeIMedia-553.exe

description	ioc	process
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\Logon\no_qrcode.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\normal\56.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\oversea\normal\7.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\oversea\normal\90.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\webctrl\MultiTab\tab_button_bkg_normal_unpushed.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\locale\es.pak	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\webapp\images\gamecenter\approve_hover.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\I18N\2052\StringBundle.xml	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-syzs-market-report.f2aeb2f0.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\webapp\images\intro_pic01.d360b15.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\RemoteControl\qrcode.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\page-login.9094cc20.js	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\imageformats\qjpeg.dll	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	C:\Program Files (x86)\k52zip\api-ms-win-core-util-l1-1-0.dll	k52zip20210520-220-21.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\hardwarecheck\button\fold_down.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\libGLESv2.dll	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\webapp\images\play_down.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\TGVoiceBuddy\I18N\1028\GFStringBundle.xml	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\TGVoiceBuddy.tpc	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\res\uninstall\64.png	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	C:\Program Files (x86)\fastpdf\qt5winextras.dll	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\normal\8.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\hover\2.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\webapp\images\hot-icon.0920899.png	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\res\uninstall\50.png	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	C:\Program Files (x86)\fastpdf\res\uninstall\10001.xml	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\component-models.5fb6ba2f.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\component-publicComponents.3de03a0b.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\I18N\1041\StringBundle.xml	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-syzs-market-ajax.7958d292.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\webapp\images\TF01.c7e662e.png	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\res\uninstall\10002.xml	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\window\OverseaTab\store_hover.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\normal\57.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\normal\83.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\oversea\hover\20.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-syzs-market-react-components.8c435163.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\page-main.208cddc9.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\webapp\images\gamecenter\code_normal.png	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\api-ms-win-crt-filesystem-l1-1-0.dll	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\gamemigrate\appdefault.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\hardwarecheck\vt.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\oversea\normal\10.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\TGVoiceBuddy\Res\button\def_hover.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\button\close_nor.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\hardwarecheck\vt_tip.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\normal\1.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\window\tab\store_normal.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\static\media\video-error.e06059f9.png	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\translations\qt_cs.qm	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	C:\Program Files (x86)\fastpdf\translations\qt_ko.qm	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-halo-jsbridge-syzs.0a2ffb95.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\api-ms-win-core-interlocked-l1-1-0.dll	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-syzs-market-utils.daf5b6c0.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\arkGraphic.dll	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\TGVoiceBuddy\I18N\1028\StringBundle.xml	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\common.dat	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\I18N\1031\GFStringBundle.xml	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\msvcp100.dll	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\res\uninstall\44.png	Fastpdf_setup_ver21042017.420.1.1.1.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\runtime.19dd9251.js	Tinst.exe
File created	C:\Program Files (x86)\fastpdf\libssl-1_1.dll	Fastpdf_setup_ver21042017.420.1.1.1.exe
File opened for modification	C:\Program Files (x86)\IMedia\IMediaDesk.exe	IMedia-553.exe
File created	\??\c:\program files\txgameassistant\appmarket\TGVoiceBuddy\Res\JoinGame\join_btn_h.png	Tinst.exe

Drops file in Windows directory 1 IoCs

Processes:

leishenzip_247915520_tiangua_001.exe

description ioc process

File created C:\Windows\Tasks\ThorUpdate.job leishenzip_247915520_tiangua_001.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\ThorUpdate.job	leishenzip_247915520_tiangua_001.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

k52zip20210520-220-21.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	k52zip20210520-220-21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	k52zip20210520-220-21.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2580 schtasks.exe

pid	process
2580	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

k52zip20210520-220-21.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	k52zip20210520-220-21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	k52zip20210520-220-21.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

SZipTray.exeSZipTray.exeSZipTray.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ADDON_MANAGEMENT\SZipTray.exe = "0"	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_XMLHTTP\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_TABBED_BROWSING\SZipTray.exe = "1"	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\SZipTray.exe = "1"	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_LEGACY_COMPRESSION	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_LEGACY_COMPRESSION	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\SZipTray.exe = "11000"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBSOCKET\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\SZipTray.exe = "11000"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_LEGACY_COMPRESSION\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\SZipTray.exe = "0"	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ADDON_MANAGEMENT\SZipTray.exe = "0"	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\SZipTray.exe = "0"	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\SZipTray.exe = "11000"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\SZipTray.exe = "0"	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XMLHTTP	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBSOCKET\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_MOVESIZECHILD\SZipTray.exe = "1"	SZipTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SPELLCHECKING\SZipTray.exe = "0"	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\SZipTray.exe = "1"	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING	SZipTray.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING\SZipTray.exe = "1"	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	SZipTray.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	SZipTray.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XMLHTTP	SZipTray.exe

Modifies registry class 64 IoCs

Processes:

SZipMd5Tool.exefastpdf_ext_process.exeThorFileManager.exekzip_main.exeregsvr32.exekzip_casual64.exeregsvr32.exefastpdf_ext_process64.exefastpdf_ext_process.exefastpdf_ext_process64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{af0cdab9-10e3-569e-aacf-a8bc0bf9c13f}\1.0\0\win32	SZipMd5Tool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\ kother_to_pdf\Icon = "C:\\Program Files (x86)\\fastpdf\\pdfconverter.exe,0"	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.lzh\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\",0"	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swm	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.rpm\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\",0"	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzma86\ = "thorzip.lzma86"	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.lzh\ = "k52zip.lzh"	kzip_main.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\k52zip.ntfs\shell\open	kzip_main.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\ qimage_extract_text\Icon = "C:\\Program Files (x86)\\fastpdf\\fastpdf.exe,0"	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0af4c9cd-825f-5677-8e7d-856f0e27270d}\Programmable	SZipMd5Tool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D722F57-3CEB-4697-AC22-9B6829F9842F}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.img\Shell	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wim\ = "thorzip.wim"	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B4DFEAB-4A11-45B9-A2D9-E12ABCD71A4E}\InprocServer32	kzip_casual64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\kzipext\ = "{B1832224-9F22-4965-A6E8-E6A6E3C4FDF7}"	kzip_casual64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.deb\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\",0"	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xls\Shell\ kother_to_pdf	fastpdf_ext_process.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.tar	kzip_main.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\k52zip.cpio\shell\open\command	kzip_main.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\k52zip.xar\shell\open	kzip_main.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ShiningZipShell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.tpz	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	ThorFileManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.xpi\DefaultIcon	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.cpio\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\" \"%1\""	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0af4c9cd-825f-5677-8e7d-856f0e27270d}\ = "ShiningZipAccer Class"	SZipMd5Tool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.tgz\DefaultIcon	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.split\ = "压缩文件"	ThorFileManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\k52zip.hfs\shell	kzip_main.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc\Shell\ kother_to_pdf\Icon = "C:\\Program Files (x86)\\fastpdf\\pdfconverter.exe,0"	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.zipx\ = "压缩文件"	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.alz\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\" \"%1\""	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.lzh	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.z	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.001\Shell\Open\Command	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\k52zip.iso\shell\open\command\ = "C:\\Program Files (x86)\\k52zip\\kzip_main.exe -from:extension_association -action:open -in=\"%1\""	kzip_main.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60D7BB01-CD27-4D13-AE76-17BD82A461E5}	fastpdf_ext_process64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0af4c9cd-825f-5677-8e7d-856f0e27270d}\TypeLib	SZipMd5Tool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60D7BB01-CD27-4D13-AE76-17BD82A461E5}\Implemented Categories	fastpdf_ext_process64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47c05740-b821-5f6f-b07a-e45adf9de811}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\ShiningZip\\"	SZipMd5Tool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip\ = "thorzip.gzip"	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "thorzip.arj"	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ fastpdf_32bit\ = "{221A55C1-C316-4b79-A259-0CED2417600D}"	fastpdf_ext_process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7660b6a6-0bf7-5252-be80-c2149103ef9c}\ProgID	SZipMd5Tool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.ace\Shell\Open	ThorFileManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.bzip2\Shell\Open\Command	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.tbz2\ = "压缩文件"	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\thorzip.jar	ThorFileManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\ kother_to_pdf\Icon = "C:\\Program Files (x86)\\fastpdf\\pdfconverter.exe,0"	fastpdf_ext_process.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\s	fastpdf_ext_process64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0af4c9cd-825f-5677-8e7d-856f0e27270d}	SZipMd5Tool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.zipx\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\" \"%1\""	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.z\OpenWithProgids\k52zip.z	kzip_main.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlsx\Shell	fastpdf_ext_process.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ fastpdf_32bit	fastpdf_ext_process.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.img	ThorFileManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.tar\Shell	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.lzh\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\雷神压缩\\ThorFileManager.exe\" \"%1\""	ThorFileManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.hfs\Shell\Open	ThorFileManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.lzma86\Shell\Open\Command	ThorFileManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\thorzip.dmg\ = "压缩文件"	ThorFileManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlsx	fastpdf_ext_process.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\k52zip.lzh\DefaultIcon\ = "C:\\Program Files (x86)\\k52zip\\kzip_main.exe"	kzip_main.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

cef_frame_render.exesyzs03_1000219144.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	cef_frame_render.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	cef_frame_render.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	syzs03_1000219144.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	syzs03_1000219144.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

fastpdf.exe

pid process

3012 fastpdf.exe

pid	process
3012	fastpdf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

IMediaB.exeTinst.exeFastpdf_setup_ver21042017.420.1.1.1.exeQMEmulatorService.exeleishenzip_247915520_tiangua_001.exeFlashZip_2710.exeSZipMd5Tool.exe

pid	process
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1668	IMediaB.exe
1784	Tinst.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1296	QMEmulatorService.exe
1604	leishenzip_247915520_tiangua_001.exe
1780	FlashZip_2710.exe
1780	FlashZip_2710.exe
1780	FlashZip_2710.exe
1780	FlashZip_2710.exe
1780	FlashZip_2710.exe
1780	FlashZip_2710.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
308	Fastpdf_setup_ver21042017.420.1.1.1.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe
1260	SZipMd5Tool.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

IMediaB.exeTinst.exeFastpdf_setup_ver21042017.420.1.1.1.exeDllHost.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1668	IMediaB.exe
Token: SeDebugPrivilege	1784	Tinst.exe
Token: SeDebugPrivilege	308	Fastpdf_setup_ver21042017.420.1.1.1.exe
Token: SeDebugPrivilege	308	Fastpdf_setup_ver21042017.420.1.1.1.exe
Token: SeIncreaseQuotaPrivilege	1132	DllHost.exe
Token: SeSecurityPrivilege	1132	DllHost.exe
Token: SeTakeOwnershipPrivilege	1132	DllHost.exe
Token: SeLoadDriverPrivilege	1132	DllHost.exe
Token: SeSystemProfilePrivilege	1132	DllHost.exe
Token: SeSystemtimePrivilege	1132	DllHost.exe
Token: SeProfSingleProcessPrivilege	1132	DllHost.exe
Token: SeIncBasePriorityPrivilege	1132	DllHost.exe
Token: SeCreatePagefilePrivilege	1132	DllHost.exe
Token: SeBackupPrivilege	1132	DllHost.exe
Token: SeRestorePrivilege	1132	DllHost.exe
Token: SeShutdownPrivilege	1132	DllHost.exe
Token: SeDebugPrivilege	1132	DllHost.exe
Token: SeSystemEnvironmentPrivilege	1132	DllHost.exe
Token: SeRemoteShutdownPrivilege	1132	DllHost.exe
Token: SeUndockPrivilege	1132	DllHost.exe
Token: SeManageVolumePrivilege	1132	DllHost.exe
Token: 33	1132	DllHost.exe
Token: 34	1132	DllHost.exe
Token: 35	1132	DllHost.exe
Token: SeIncreaseQuotaPrivilege	1132	DllHost.exe
Token: SeSecurityPrivilege	1132	DllHost.exe
Token: SeTakeOwnershipPrivilege	1132	DllHost.exe
Token: SeLoadDriverPrivilege	1132	DllHost.exe
Token: SeSystemProfilePrivilege	1132	DllHost.exe
Token: SeSystemtimePrivilege	1132	DllHost.exe
Token: SeProfSingleProcessPrivilege	1132	DllHost.exe
Token: SeIncBasePriorityPrivilege	1132	DllHost.exe
Token: SeCreatePagefilePrivilege	1132	DllHost.exe
Token: SeBackupPrivilege	1132	DllHost.exe
Token: SeRestorePrivilege	1132	DllHost.exe
Token: SeShutdownPrivilege	1132	DllHost.exe
Token: SeDebugPrivilege	1132	DllHost.exe
Token: SeSystemEnvironmentPrivilege	1132	DllHost.exe
Token: SeRemoteShutdownPrivilege	1132	DllHost.exe
Token: SeUndockPrivilege	1132	DllHost.exe
Token: SeManageVolumePrivilege	1132	DllHost.exe
Token: 33	1132	DllHost.exe
Token: 34	1132	DllHost.exe
Token: 35	1132	DllHost.exe
Token: SeIncreaseQuotaPrivilege	2936	wmic.exe
Token: SeSecurityPrivilege	2936	wmic.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

fastpdf_ext_process64.exefastpdf_ext_process64.exefastpdf_ext_process64.exeSZipTray.exeAppMarket.exekzip_casual64.exe

pid	process
868	fastpdf_ext_process64.exe
1312	fastpdf_ext_process64.exe
2164	fastpdf_ext_process64.exe
2124	SZipTray.exe
380	AppMarket.exe
2200	kzip_casual64.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

AppMarket.exe

pid process

380 AppMarket.exe

pid	process
380	AppMarket.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

IMedia-553.exeIMediaB.exeIMedia.exerundll32.exefastpdf.exe

pid	process
1000	IMedia-553.exe
1000	IMedia-553.exe
1000	IMedia-553.exe
1668	IMediaB.exe
1668	IMediaB.exe
944	IMedia.exe
1344	rundll32.exe
3012	fastpdf.exe
3012	fastpdf.exe
3012	fastpdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

789543351b1c5d10216ff9319e835a3c.exeIMedia-553.exeIMediaDesk.exerundll32.exesyzs03_1000219144.exe

description	pid	process	target process
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 1000	1996	789543351b1c5d10216ff9319e835a3c.exe	IMedia-553.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1996 wrote to memory of 568	1996	789543351b1c5d10216ff9319e835a3c.exe	syzs03_1000219144.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1668	1000	IMedia-553.exe	IMediaB.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1892	1000	IMedia-553.exe	IMediaT.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 1680	1000	IMedia-553.exe	IMediaDesk.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1000 wrote to memory of 944	1000	IMedia-553.exe	IMedia.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 1680 wrote to memory of 864	1680	IMediaDesk.exe	rundll32.exe
PID 864 wrote to memory of 1344	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1344	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1344	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1344	864	rundll32.exe	rundll32.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1304	568	syzs03_1000219144.exe	Market.exe
PID 568 wrote to memory of 1784	568	syzs03_1000219144.exe	Tinst.exe
PID 568 wrote to memory of 1784	568	syzs03_1000219144.exe	Tinst.exe
PID 568 wrote to memory of 1784	568	syzs03_1000219144.exe	Tinst.exe
PID 568 wrote to memory of 1784	568	syzs03_1000219144.exe	Tinst.exe

C:\Users\Admin\AppData\Local\Temp\789543351b1c5d10216ff9319e835a3c.exe
"C:\Users\Admin\AppData\Local\Temp\789543351b1c5d10216ff9319e835a3c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\IMedia-553.exe
"C:\Users\Admin\AppData\Local\Temp\IMedia-553.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000

C:\Program Files (x86)\IMedia\IMediaB.exe
"C:\Program Files (x86)\IMedia\IMediaB.exe" install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Program Files (x86)\IMedia\IMediaT.exe
"C:\Program Files (x86)\IMedia\IMediaT.exe" install
3⤵
- Executes dropped EXE
PID:1892

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /TN _Newdd_ddddfgd_sdfqefjkjkjkj_IMedia_e3df_TEE /f
4⤵
PID:2248

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc ONLOGON /tn _Newdd_ddddfgd_sdfqefjkjkjkj_IMedia_e3df_TEE /tr "\"C:\Program Files (x86)\IMedia\IMediaB.exe\" taskactive" /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:2580

C:\Program Files (x86)\IMedia\IMediaDesk.exe
"C:\Program Files (x86)\IMedia\IMediaDesk.exe" install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" /s "C:\Program Files (x86)\IMedia\IMedia64.dll" DllGetClassObjectEx
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" /s "C:\Program Files (x86)\IMedia\IMedia64.dll" DllGetClassObjectEx
5⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Program Files (x86)\IMedia\IMedia.exe
"C:\Program Files (x86)\IMedia\IMedia.exe" install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:944

C:\Users\Admin\AppData\Local\Temp\syzs03_1000219144.exe
"C:\Users\Admin\AppData\Local\Temp\syzs03_1000219144.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:568

C:\Temp\TxGameDownload\Component\AppMarket\da12dfb041b409e76d6661e7ad02eb9b\Market.exe
"C:\Temp\TxGameDownload\Component\AppMarket\da12dfb041b409e76d6661e7ad02eb9b\Market.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304

C:\Temp\TxGameDownload\Component\AppMarket\da12dfb041b409e76d6661e7ad02eb9b\Setup\Tinst.exe
"C:\Temp\TxGameDownload\Component\AppMarket\da12dfb041b409e76d6661e7ad02eb9b\Setup\Tinst.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\SysWOW64\Netsh.exe
"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AppMarket" dir=in program="c:\program files\txgameassistant\appmarket\AppMarket.exe" action=allow
4⤵
PID:1248

C:\Windows\SysWOW64\Netsh.exe
"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TInst" dir=in program="c:\program files\txgameassistant\appmarket\TInst.exe" action=allow
4⤵
PID:944

C:\Windows\SysWOW64\Netsh.exe
"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="bugreport" dir=in program="c:\program files\txgameassistant\appmarket\bugreport.exe" action=allow
4⤵
PID:2692

C:\Windows\SysWOW64\Netsh.exe
"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="QQExternal" dir=in program="c:\program files\txgameassistant\appmarket\QQExternal.exe" action=allow
4⤵
PID:3040

C:\Windows\SysWOW64\Netsh.exe
"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="GameDownload" dir=in program="c:\program files\txgameassistant\appmarket\GameDownload.exe" action=allow
4⤵
PID:2144

C:\Windows\SysWOW64\Netsh.exe
"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allow
4⤵
PID:2736

C:\Program Files\TxGameAssistant\AppMarket\AppMarket.exe
"C:\Program Files\TxGameAssistant\AppMarket\AppMarket.exe" -from TGBDownloader
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:380

C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe
"C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe" --conf-path="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.cfg" --daemon --log="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.log"
4⤵
- Executes dropped EXE
PID:2952

C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
"C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=gpu-process --field-trial-handle=1544,1772521916539651268,12710239653088696950,131072 --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.10.1683.80" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --service-request-channel-token=9115796099887616284 --mojo-platform-channel-handle=1552 /prefetch:2
4⤵
- Executes dropped EXE
PID:2480

C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
"C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=utility --field-trial-handle=1544,1772521916539651268,12710239653088696950,131072 --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.10.1683.80" --lang=en-US --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --service-request-channel-token=7180306919436594155 --mojo-platform-channel-handle=2192 /prefetch:8
4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:520

C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
"C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=renderer --no-sandbox --force-device-scale-factor=1.00 --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --field-trial-handle=1544,1772521916539651268,12710239653088696950,131072 --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.10.1683.80" --disable-pdf-extension=1 --ppapi-flash-path="PepperFlash\pepflashplayer.dll" --ppapi-flash-version=18.0.0.209 --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=9243039703749771914 --renderer-client-id=3 --mojo-platform-channel-handle=2208 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
PID:2424

C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
"C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=gpu-process --field-trial-handle=1544,1772521916539651268,12710239653088696950,131072 --disable-features=OutOfBlinkCors --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.10.1683.80" --lang=en-US --gpu-preferences=KAAAAAAAAADoAAAgAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --service-request-channel-token=45190832804297831 --mojo-platform-channel-handle=2032 /prefetch:2
4⤵
- Executes dropped EXE
PID:1976

C:\Users\Admin\AppData\Local\Temp\Fastpdf_setup_ver21042017.420.1.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\Fastpdf_setup_ver21042017.420.1.1.1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:308

C:\Program Files (x86)\fastpdf\fastpdf_ext_process64.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process64.exe" /ext:1
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:868

C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe" /action:install
4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Modifies registry class
PID:1064

C:\Program Files (x86)\fastpdf\fastpdf_ext_process64.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process64.exe" /ext:1
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1312

C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe" /action:install
4⤵
- Modifies system executable filetype association
- Executes dropped EXE
PID:2068

C:\Program Files (x86)\fastpdf\fastpdf_ext_process64.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process64.exe" /ext:1
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2164

C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe" /action:install
4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Modifies registry class
PID:2196

C:\Program Files (x86)\fastpdf\fastpdf.exe
"C:\Program Files (x86)\fastpdf\fastpdf.exe" -refreshdesktop=1
3⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\fastpdf\fastpdf.exe
"C:\Program Files (x86)\fastpdf\fastpdf.exe" -associate=1
3⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\leishenzip_247915520_tiangua_001.exe
"C:\Users\Admin\AppData\Local\Temp\leishenzip_247915520_tiangua_001.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1604

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\雷神压缩\ThorShell64.dll
3⤵
PID:2860

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\雷神压缩\ThorHelp64.dll
3⤵
PID:900

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\雷神压缩\ThorService.dll
3⤵
PID:1460

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\雷神压缩\ThorShell64.dll
3⤵
PID:524

C:\Windows\system32\regsvr32.exe
/s C:\Users\Admin\AppData\Roaming\雷神压缩\ThorShell64.dll
4⤵
- Modifies system executable filetype association
PID:2736

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\雷神压缩\ThorHelp64.dll
3⤵
PID:1080

C:\Windows\system32\regsvr32.exe
/s C:\Users\Admin\AppData\Roaming\雷神压缩\ThorHelp64.dll
4⤵
- Modifies registry class
PID:304

C:\Users\Admin\AppData\Roaming\雷神压缩\ThorFileManager.exe
"C:\Users\Admin\AppData\Roaming\雷神压缩\ThorFileManager.exe" --register_application
3⤵
- Executes dropped EXE
- Modifies registry class
PID:1692

C:\Users\Admin\AppData\Roaming\雷神压缩\ThorReport.exe
"C:\Users\Admin\AppData\Roaming\雷神压缩\ThorReport.exe"
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1880

C:\Users\Admin\AppData\Local\Temp\FlashZip_2710.exe
"C:\Users\Admin\AppData\Local\Temp\FlashZip_2710.exe" -8122a41aa4ae
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1780

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCWNYmzoMeWFUU0CM2Dtga35YuzOEd3hN6CIB20FaUT10MxhIaCtAGtPOMDxEPyeMSm2ET0QMbW2FqhSNiGtFdl6IoCU0j1HZsj4ZsmYNu2YI25oZFmfYXybYnmgMH9ZNXzJgP5UNeTGQCz8MJzJU7x3YajkFNjZNLW9QuxyMbDxIHx5NRmCZDmZOTTFMnxpOsWFUG4nMyztVkhPMa29MRudZtXLholy -2596b1ef9f0a=27
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1260

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\ShiningZip\ZipCnu64.dll"
4⤵
PID:2140

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\ShiningZip\ZipCnu64.dll"
5⤵
- Modifies registry class
PID:2216

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNgm1oYejFcU4CZ2Dthaj5ZujOZdmhN6yIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2Aq=S -2596b1ef9f0a=27
4⤵
PID:2424

C:\Users\Admin\AppData\Local\Temp\OfficeDownloaderInstall_0_100016_lanshan.exe
"C:\Users\Admin\AppData\Local\Temp\OfficeDownloaderInstall_0_100016_lanshan.exe"
2⤵
- Executes dropped EXE
PID:1664

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic bios get SerialNumber
3⤵
PID:1132

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic bios get SerialNumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic bios get SerialNumber
3⤵
PID:2620

C:\Users\Admin\AppData\Local\Temp\k52zip20210520-220-21.exe
C:\Users\Admin\AppData\Local\Temp\k52zip20210520-220-21.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2736

C:\Program Files (x86)\k52zip\kzip_casual64.exe
"C:\Program Files (x86)\k52zip\kzip_casual64.exe" --worker=kzip_ext --register
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2200

C:\Program Files (x86)\k52zip\kzip_main.exe
"C:\Program Files (x86)\k52zip\kzip_main.exe" -action:assext
3⤵
- Executes dropped EXE
- Modifies registry class
PID:2660

C:\Program Files (x86)\k52zip\krecommend.exe
"C:\Program Files (x86)\k52zip\krecommend.exe" /product:11 /type:1 /sence:1
3⤵
- Executes dropped EXE
PID:2740

C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe
"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1296

C:\Program Files (x86)\fastpdf\fpprotect.exe
"C:\Program Files (x86)\fastpdf\fpprotect.exe"
1⤵
- Executes dropped EXE
PID:816

C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe
"C:\Program Files (x86)\fastpdf\fastpdf_ext_process.exe" -action:check_plugin_register
2⤵
PID:1064

C:\Program Files (x86)\fastpdf\fastpdf.exe
"C:\Program Files (x86)\fastpdf\fastpdf.exe" -sactive=1
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3012

C:\Users\Admin\AppData\Local\ShiningZip\SZipService.exe
C:\Users\Admin\AppData\Local\ShiningZip\SZipService.exe -3ba07688d9f4
1⤵
- Executes dropped EXE
PID:2236

C:\Users\Admin\AppData\Local\ShiningZip\SZipUpdate.exe
C:\Users\Admin\AppData\Local\ShiningZip\SZipUpdate.exe -e61475c863c7=27 -c9c0eef9ccd6=LCTNNmioOeDFZUkCN2jtga55YuWOJdlhM6SIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2Qq=S -2596b1ef9f0a=27
2⤵
- Executes dropped EXE
PID:2432

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe -e61475c863c7=27 -c9c0eef9ccd6=LCTNEm2oNeDFFUiCN22tMa25ZuTOldjhZ6SIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2Qq=S -2596b1ef9f0a=27
2⤵
- Executes dropped EXE
PID:2460

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNgm1oYejFcU4CZ2Dthaj5ZujOZdmhN6yIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2Qq=S -2596b1ef9f0a=27
3⤵
- Executes dropped EXE
PID:2768

C:\Users\Admin\AppData\Local\ShiningZip\SZipTray.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipTray.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCWNYm0oZeDFgU1CN2DtNam5Yu2OYd5hM6iIA2tFNUG1YMyhOaTtEG0PYM2xIP3eMSD2NTjQPbT2Iq3SIiCt0d36MoGUYjxHOsT4FsjYZuDYc25oOFWfIX9bMnygAHtZZXTJEP5UYejGVCj8OJTJN7i3MaTkgNwZPLT9AugyLbTxEH25MRTCkD4ZMTjFAn3pNsGFJGinYyTt0kwPIaC90RzdYtTLQowyZWDSZIhTYZjVggx9Y0zGks9nMkjWEH=z -2596b1ef9f0a=27
4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:3064

C:\Users\Admin\AppData\Local\ShiningZip\SZipTray.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipTray.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNMmyoOeTFNUkCO2WtUay5MuGOEdyhN6yIA2tFNUG1YMyhOaTtEG0PYM2xIP3eMSD2NTjQPbX2sqiSaiWtQdi6OojUEj2HNsy4wsiYdujYE2ioOFjfEXsbInngVHyZbXCJIP6UIemGhC08dJHJA763Layk9NkZbLC95uiyabWx5Hn5aRHCVDvZaT2FVnqpasSF5Gjnbyit9kGPbaG9FRzdatFLpopycWCS9I0TcZ2Vtgf9Y0mGpsynakiWIHszIJmO1vkNNgSpI46vIgjYY11TZdjqd5ihNkGTMSyjY0znMzyZM3GzITybNT2QUiw6N1jyciwUNWmPRrmEYv2mUP29MfGLFxlkZnjnAyzgI6imwCiDYh2U9QufZnmjlXndI2jypS79IAmYxDhTb8mXQWi7OkjdEWshI4mGlLuHdoGXVmyRdzCHIg6PMzSHwiiZctGrFpyMYpWD03i8OyirJETaa5GFFsuKWFm1lCwMITi1wEiiZuGTxksob3WjFXp6bPi4IX6NIaljJZ1AbDkB1ihmapWS4MiLfaXl04=v -2596b1ef9f0a=27
4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies Internet Explorer settings
PID:2444

C:\Users\Admin\AppData\Local\ShiningZip\SZipTray.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipTray.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNMmyoOeTFNUkCO2WtUay5MuGOEdyhN6yIA2tFNUG1YMyhOaTtEG0PYM2xIP3eMSD2NTjQPbX2sqiSaiWtQdi6OojUEj3HNsi4wsiYdujYE2ioOFjfIXsbInngVHyZbXCJIP6UIemGhC08dJHJA763Layk9NkZbLC95uiyabWx5Hn5aRHCVDvZaT2FVnqpasSF5Gjnbyit9kkPLa29lRtdZt3LMovycW3SlI5TbZmVcgu9c0GG5snnIkiWwHizbJWOQv1NIgjpo4ivMgjYl1lTMdTqd5hhYkjTASyjY0znAzwZM32zUT1bMTmQQi56M1myYi5UNWWPMr3EMvWmVPl9NfjLhxlkYn2nMyigL6CmJCjDbh2U5QmfanWjcXidO2nysSi9bAGYFDuTZ8CXIW67MkSdwWiha4WG5L0HZoXXJm0RIzjHogxPLzCHJiwZYtXrJphMbpSDI368IyirIEsaI5mFRssKbFG11ChMaTW14EiiOuiTJksoa3WjJXm6dPW45XfNda2jVZpAeDWBEiimfpXS0M=L -2596b1ef9f0a=27
4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:2124

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k szpsrvrGroup
1⤵
PID:2344

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21057177761508207670-1544064430-524852810-405224341-371968621-1937152521-1832419601"
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k thorzip_updatesvc
1⤵
PID:1168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k thorzip_updatesvc
1⤵
PID:1312

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNRmjoOeDFIU5CO2Dtdam5NuGOQd0hM6yIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2IqgS -2596b1ef9f0a=27
1⤵
- Executes dropped EXE
PID:1900

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNEm2oNeDFFUiCN22tMa25ZuTOldjhZ6SIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2Iq=S -2596b1ef9f0a=27
1⤵
- Executes dropped EXE
PID:1564

C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe
"C:\Users\Admin\AppData\Local\ShiningZip\SZipMd5Tool.exe" -e61475c863c7=27 -c9c0eef9ccd6=LCTNgm1oYejFcU4CZ2Dthaj5ZujOZdmhN6yIA2tFMUj1IMyhYaTtQG4PNMmxNPkeMSz2NTkQPbT2Iq=S -2596b1ef9f0a=27
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1672

C:\Program Files (x86)\k52zip\kzipservice.exe
"C:\Program Files (x86)\k52zip\kzipservice.exe"
1⤵
- Executes dropped EXE
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Bootkit

T1067

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

System Information Discovery