7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b

Analysis

max time kernel
153s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe
Size

148KB
MD5

713e68047e3e0a63d3c28c3c886d1530
SHA1

628944a797fd74141faad175f8eeb9e78c6a83ec
SHA256

7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b
SHA512

b995aaaee0578a3361b10d2692267985bf926b73a54d8012c8fb7e7cc056d8e0fd8ebc913acf61ed0258ffa594f1d6c4735460e6ff4f8aed7e8ea1d7d6b3dde8
SSDEEP

3072:KX5H3oUhFBpQhvrHQc5LDUUn1Ir/sFdhq4G:KpH3oUhahvrHQc5LNIrezq4G

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4752	8bAtW5NrLFejgc8.exe
2128	script.exe
4248	smss.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	8bAtW5NrLFejgc8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
3760	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\flashget = "c:\\windows\\20221002\\58yp288k8b5cupqh\\smss.exe "	reg.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regedit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\Script.vbs.bat	script.exe
File created	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\MyShowIeLinkIe7.reg	WScript.exe
File created	C:\Windows\search.reg	WScript.exe
File opened for modification	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe	8bAtW5NrLFejgc8.exe
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\reg.bat	8bAtW5NrLFejgc8.exe
File created	C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe	8bAtW5NrLFejgc8.exe
File created	C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe.bat	8bAtW5NrLFejgc8.exe
File created	C:\Windows\userid.txt	script.exe
File created	C:\Windows\MYShowIeLinkIe6.reg	WScript.exe
File created	C:\Windows\yctbmd.vbs	WScript.exe
File created	C:\Windows\Survival_0.txt	smss.exe
File created	C:\Windows\AddRight.reg	WScript.exe
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.vbs	8bAtW5NrLFejgc8.exe
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\regBHO.reg	8bAtW5NrLFejgc8.exe
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\XlKankan.dll	8bAtW5NrLFejgc8.exe
File created	C:\Windows\tao.ico	8bAtW5NrLFejgc8.exe
File created	C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe.bat	8bAtW5NrLFejgc8.exe
File opened for modification	C:\Windows\SysWOW64	xcopy.exe
File created	C:\Windows\.reg	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\URL = "http://www.mylovewebs.com/api/baidu/so.htm?word={searchTerms}"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\SortIndex = "2"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/index.htm"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/youdao.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 65cf80b551e1c349b73f70b13fca8e86	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\DisplayName = "ÌÔ±¦ËÑË÷"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/google.htm"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconURL = "http://www.taobao.com/favicon.ico"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Explorer\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\URL = "http://www.mylovewebs.com/api/taobao/so.htm?word={searchTerms}"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/baidu.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{E140FB5B-2A9D-4FA4-A20F-089B92412200}.ico"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c0000000000000468100000010000000feb8496527bbc90112c0b16e27bbc9015aac066827bbc9010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008c3acb231000444f43554d457e310000440003000400efbe8c3ada218c3acb231400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a003100000000008c3acc23100041444d494e497e310000320003000400efbe8c3acb238c3acc2314000000410064006d0069006e006900730074007200610074006f0072000000180056003100000000008c3ace2311004641564f52497e3100003e0003000400efbe8c3acb238c3ace23140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d313236393300180030003500000000008c3acf231000fe94a56300001c0003000400efbe8c3acc238c3acf2314000000fe94a56300001400000060000000030000a0580000000000000067686f73747870332d3436373638300008fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa208fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa200000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000030000002003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}.ico"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\LinksFolderName = "Á´½Ó"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c00000000000004681000000100000009ed10ec233ecca01e61abf65c5edca019ed10ec233ecca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c00310000000000a53c284a1000444f43554d457e310000440003000400efbea53c1249a73cf1481400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a63c8e0c100041444d494e497e310000320003000400efbea53c284aa73cf14814000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a63c760f11004641564f52497e3100003e0003000400efbea53c284aa73c3344140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a53c294a1000fe94a56300001c0003000400efbea53c294aa73c334414000000fe94a56300001400000060000000030000a0580000000000000068792d3636796c7032363264663675000ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e00026180888870ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e000261808888700000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000340000001b000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\SortIndex = "6"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006200000001000000a0060000a00f000005000000220400002600000002000000a10600006001000004000000a1000000c600000003000000a1020000d4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000030000000140000002a000000010000008006000080010000030000008102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{F2CF5485-4E02-4F68-819C-B92DE9277049} = 8554cff2024e684f819cb92de927704922001c000800000006000000010000000000000000000000000000004c0000000114020000000000c000000000000046810000001000000010a155c0ffe9ca0118bf0ffd11edca0118bf0ffd11edca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008e3ab9151000444f43554d457e310000440003000400efbe8c3ada21a23c2c701400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a53c0586100041444d494e497e310000320003000400efbe8c3acb23a53c058614000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a23c809611004641564f52497e3100003e0003000400efbea23c0070a23c8096140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a63ce45d1000fe94a56300001c0003000400efbea23c0070a63ce45d14000000fe94a56300001400000060000000030000a058000000000000007063323031303035303232317663620008fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824608fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824600000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\DisplayName = "°Ù¶ÈÒ»ÏÂ£¬Äã¾ÍÖªµÀ"	regedit.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1274"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1274"	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command\ = "Rundll32.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR\ = "C:\\Windows\\System32"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\ = "00.00.00.00"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ = "Internet Explorer"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.zaodezhu.com/?my=1274"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\ = "´ò¿ªÖ÷Ò³(&H)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ProgID\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.txt = "txtfile"	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\ = "QvodAdBlocker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\ = "É¾³ý(&D)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.ini = "inifile"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "AllTypes"	script.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "AllTypes"	script.exe

Runs .reg file with regedit 8 IoCs

pid	Process
4816	regedit.exe
2408	regedit.exe
228	regedit.exe
2116	regedit.exe
3132	regedit.exe
2004	regedit.exe
1940	regedit.exe
712	regedit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4248	smss.exe
4248	smss.exe
4248	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3268	2408	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe	82
PID 2408 wrote to memory of 3268	2408	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe	82
PID 2408 wrote to memory of 3268	2408	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe	82
PID 2408 wrote to memory of 876	2408	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe	84
PID 2408 wrote to memory of 876	2408	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe	84
PID 2408 wrote to memory of 876	2408	7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe	84
PID 3268 wrote to memory of 4752	3268	cmd.exe	86
PID 3268 wrote to memory of 4752	3268	cmd.exe	86
PID 3268 wrote to memory of 4752	3268	cmd.exe	86
PID 4752 wrote to memory of 4620	4752	8bAtW5NrLFejgc8.exe	87
PID 4752 wrote to memory of 4620	4752	8bAtW5NrLFejgc8.exe	87
PID 4752 wrote to memory of 4620	4752	8bAtW5NrLFejgc8.exe	87
PID 4620 wrote to memory of 2128	4620	cmd.exe	89
PID 4620 wrote to memory of 2128	4620	cmd.exe	89
PID 4620 wrote to memory of 2128	4620	cmd.exe	89
PID 4752 wrote to memory of 1688	4752	8bAtW5NrLFejgc8.exe	90
PID 4752 wrote to memory of 1688	4752	8bAtW5NrLFejgc8.exe	90
PID 4752 wrote to memory of 1688	4752	8bAtW5NrLFejgc8.exe	90
PID 2128 wrote to memory of 1252	2128	script.exe	92
PID 2128 wrote to memory of 1252	2128	script.exe	92
PID 2128 wrote to memory of 1252	2128	script.exe	92
PID 2128 wrote to memory of 3788	2128	script.exe	94
PID 2128 wrote to memory of 3788	2128	script.exe	94
PID 2128 wrote to memory of 3788	2128	script.exe	94
PID 3788 wrote to memory of 228	3788	cmd.exe	96
PID 3788 wrote to memory of 228	3788	cmd.exe	96
PID 3788 wrote to memory of 228	3788	cmd.exe	96
PID 3788 wrote to memory of 1940	3788	cmd.exe	97
PID 3788 wrote to memory of 1940	3788	cmd.exe	97
PID 3788 wrote to memory of 1940	3788	cmd.exe	97
PID 3788 wrote to memory of 3760	3788	cmd.exe	98
PID 3788 wrote to memory of 3760	3788	cmd.exe	98
PID 3788 wrote to memory of 3760	3788	cmd.exe	98
PID 1252 wrote to memory of 3952	1252	cmd.exe	99
PID 1252 wrote to memory of 3952	1252	cmd.exe	99
PID 1252 wrote to memory of 3952	1252	cmd.exe	99
PID 1688 wrote to memory of 4248	1688	cmd.exe	100
PID 1688 wrote to memory of 4248	1688	cmd.exe	100
PID 1688 wrote to memory of 4248	1688	cmd.exe	100
PID 4752 wrote to memory of 1248	4752	8bAtW5NrLFejgc8.exe	105
PID 4752 wrote to memory of 1248	4752	8bAtW5NrLFejgc8.exe	105
PID 4752 wrote to memory of 1248	4752	8bAtW5NrLFejgc8.exe	105
PID 3952 wrote to memory of 2320	3952	WScript.exe	107
PID 3952 wrote to memory of 2320	3952	WScript.exe	107
PID 3952 wrote to memory of 2320	3952	WScript.exe	107
PID 3952 wrote to memory of 2020	3952	WScript.exe	109
PID 3952 wrote to memory of 2020	3952	WScript.exe	109
PID 3952 wrote to memory of 2020	3952	WScript.exe	109
PID 3952 wrote to memory of 4612	3952	WScript.exe	111
PID 3952 wrote to memory of 4612	3952	WScript.exe	111
PID 3952 wrote to memory of 4612	3952	WScript.exe	111
PID 3952 wrote to memory of 1952	3952	WScript.exe	171
PID 3952 wrote to memory of 1952	3952	WScript.exe	171
PID 3952 wrote to memory of 1952	3952	WScript.exe	171
PID 3952 wrote to memory of 1792	3952	WScript.exe	115
PID 3952 wrote to memory of 1792	3952	WScript.exe	115
PID 3952 wrote to memory of 1792	3952	WScript.exe	115
PID 3952 wrote to memory of 2268	3952	WScript.exe	117
PID 3952 wrote to memory of 2268	3952	WScript.exe	117
PID 3952 wrote to memory of 2268	3952	WScript.exe	117
PID 3952 wrote to memory of 2160	3952	WScript.exe	119
PID 3952 wrote to memory of 2160	3952	WScript.exe	119
PID 3952 wrote to memory of 2160	3952	WScript.exe	119
PID 3952 wrote to memory of 3132	3952	WScript.exe	121

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2320	attrib.exe
672	attrib.exe
4648	attrib.exe
2500	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe
"C:\Users\Admin\AppData\Local\Temp\7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe
    "C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe
        
        "C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\20221002\efkki2NfQbIW5CsL\script\Script.vbs.bat" "
        6⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.vbs"
        7⤵
        Checks computer location settings
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:2320
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrators
        8⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c Administrators:CI
        8⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrator
        8⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r users
        8⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r system
        8⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r everyone
        8⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r user
        8⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Power Users"
        8⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Admin"
        8⤵
        
        PID:416
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:672
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrators
        8⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c Administrators:CI
        8⤵
        
        PID:444
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrator
        8⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r users
        8⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r system
        8⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r everyone
        8⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r user
        8⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Power Users"
        8⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Admin"
        8⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:4648
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrators
        8⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c Administrators:CI
        8⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrator
        8⤵
        
        PID:740
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r users
        8⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r system
        8⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r everyone
        8⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r user
        8⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Power Users"
        8⤵
        
        PID:396
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Admin"
        8⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:2500
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r Administrators
        8⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c Administrators:CI
        8⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r Administrator
        8⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r users
        8⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r system
        8⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r everyone
        8⤵
        
        PID:4600
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:416
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r user
        8⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r "Power Users"
        8⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt" /e /c /r "Admin"
        8⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
        8⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Runs .reg file with regedit
        
        PID:712
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\MYShowIeLinkIe6.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:4816
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\MyShowIeLinkIe7.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:2408
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\search.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:228
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\.reg
        8⤵
        Modifies registry class
        Runs .reg file with regedit
        
        PID:2116
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\AddRight.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:3132
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
        8⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Runs .reg file with regedit
        
        PID:2004
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\20221002\efkki2NfQbIW5CsL\script\reg.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /c /q /y /i XlKankan.dll C:\Windows\system32
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Enumerates system info in registry
        
        PID:228
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regBHO.reg
        7⤵
        Installs/modifies Browser Helper Object
        Runs .reg file with regedit
        
        PID:1940
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s XlKankan.dll
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe
        
        "C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:4248
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "flashget" /d "c:\windows\20221002\58yp288k8b5cupqh\smss.exe " /f
        6⤵
        Adds Run key to start application
        
        PID:1008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe.bat" "
      4⤵
      PID:1248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe.bat" "
  2⤵
  PID:876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Admin\AppData\Local\Temp\7d86a0c6ebbcd2f83f695579bd48b5ecea7c8ff8a7b365eb88b721c3bc0d854b.exe.bat

Filesize
525B

MD5
822cc4130df1143aac9fe92cc1825410

SHA1
eece9811ea5c2277276a0a4066740928cb2706ef

SHA256
b238ea1754a74c1da7709355651fd4d7327dbf0536b249517b599b0dd8737c07

SHA512
fb65956d089cc0e60813c0d038a90fdb35e40b5920fb70aa0fea5e946045b7604b44f3b04a6b90ed410c186f139559bc6b6b35fc3fc46eb02619ae2dc53ee92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe

Filesize
111KB

MD5
fa1c8c4a83913e8639ac4227231f7ad1

SHA1
a415cfc290360a5c76a00759a6c055f0d7c27194

SHA256
f078e063e32f521d16a7cb253099de14ed7f52c0882058734bfb47caf9b1a07b

SHA512
dbd0278f51738033f2934d9039acbb980ecacb50bcea6710c1419206349e76a919455af00f91059c4b2694de46fb1c483d39e7bd191cf36a3ceffdf124157ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe

Filesize
111KB

MD5
fa1c8c4a83913e8639ac4227231f7ad1

SHA1
a415cfc290360a5c76a00759a6c055f0d7c27194

SHA256
f078e063e32f521d16a7cb253099de14ed7f52c0882058734bfb47caf9b1a07b

SHA512
dbd0278f51738033f2934d9039acbb980ecacb50bcea6710c1419206349e76a919455af00f91059c4b2694de46fb1c483d39e7bd191cf36a3ceffdf124157ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe.bat

Filesize
207B

MD5
f22df5d84b19dcdaff0d6019b7748699

SHA1
b03ca889a51be470a34bb5fdc7803e97f89ff541

SHA256
9fff075fc6d43db0b200cc1a4f4892ed3a58b71017f81c256653d1b0992cceb7

SHA512
c91a0f07d6062480066bd9ed86e7ce4a565e899278593cf9af714ef75c9ee888d838deaa6ddc73c82b3206a7215b060c78e5181323a89ef782fb4d4141ca5102

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bAtW5NrLFejgc8.exe.bat

Filesize
329B

MD5
7bdc702292e1b39a7a39d7d65110f7b8

SHA1
6cad5c3792b2ece82bd6c1e3f823039e59b18cc6

SHA256
9c5d1c3a3c1f122ebf80d6675069a7b20b89b49a370c17985627313f434ae5c0

SHA512
b6a56f0c9b765c123a5c951bf84624d2bc55db462843116ea868c51cc9136848185d6648cf341ef5560f6ba38af74c06a2f28cdd9d8219625cb06df39f182510

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Public\Desktop\Internet Explorer.tt

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Public\Desktop\¹ºÎïÌÔ±¦.bt

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Windows\.reg

Filesize
1KB

MD5
65bf25de434a6cfb78b5cd949957ab62

SHA1
738fed948972912548fddce4a763d4c4ff94ee05

SHA256
0c9ebb8044661c0824d7e4fd3b6462b6671a5bff1185e3ffd8b151322aa6b43d

SHA512
377fd8318f762b153bb2ccb5f08504cb9a9ac38cf754ed7cf03dd3ea67a244c6c342700fdc387c7cf684f177a65bd5b2f2c73dc7925bd454135609b4f67ddaeb

Download Submit
C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe

Filesize
16.1MB

MD5
7c434fdf08d8146f85bc5feb0bebc31e

SHA1
a546596add65eb288595679b8098af0f371ccd62

SHA256
76ed426ea75992d0eef0a6ff9ca306c8c9ba78530be06ee4c6d88b60d482b391

SHA512
c0c2f6df2ab01e693a0f23c78c2370703fcb049c645e7daa44f77d9e85ee696c441d71ba6d85f6bc052aca7714ad2328c6c013cd600507594f2c83da984a5e0b

Download Submit
C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe

Filesize
16.1MB

MD5
7c434fdf08d8146f85bc5feb0bebc31e

SHA1
a546596add65eb288595679b8098af0f371ccd62

SHA256
76ed426ea75992d0eef0a6ff9ca306c8c9ba78530be06ee4c6d88b60d482b391

SHA512
c0c2f6df2ab01e693a0f23c78c2370703fcb049c645e7daa44f77d9e85ee696c441d71ba6d85f6bc052aca7714ad2328c6c013cd600507594f2c83da984a5e0b

Download Submit
C:\Windows\20221002\58yP288k8B5CUpqh\smss.exe.bat

Filesize
183B

MD5
9e0911d885ff5cac4cad5c9cdb1fd4a8

SHA1
fd975314914fbacfbef60f577264fbb78d04bfd8

SHA256
82589c056ef1e2fc982c74d9977e9f24642146e42bdc2fd9ce45b4141be25f5f

SHA512
66e75c2c9442b4df9415d26be7eb94de57222d4cde36da0b226cf3bfd6df45bbfb51ea7e361b8e07445c26b01fca10f6142f5c9130051b10b38b92e26325c8e2

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\Script.vbs.bat

Filesize
210B

MD5
51cd0ae1dd097c04cf66492c19362571

SHA1
f4849e4baea01327a099df249d26b530c45d37c6

SHA256
2563239d8783a6fdfb47fbb583263ab0a404dde3bae51a950c8e8fffbc69e67b

SHA512
80f7a0c4bb7d2a5207fc0b9f06a0d55f70ec47ef296aa9943963fb3e4d4222c7f0b929e10d64ab978740623c831035e99e4d1978a669457dbd518bd3b92531bb

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\reg.bat

Filesize
130B

MD5
d426a1646ddadd0e41ff5358eeceb3c4

SHA1
69e585d10ad1f4d03a4ceec7f4e336951e10406f

SHA256
86861d7856b53976d754875343237f55e63ca5580db3e57f6ffbbc86977ef573

SHA512
401c3aa8a1a426cb7c6fdfc0e0cd5da193abb8c44c17143996e57838060f22601c51fc3a3da915d0ac3a3f7a70a217fa9576c575bc9f5a30b542c9a5a206dd97

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\regBHO.reg

Filesize
356B

MD5
b93db4ec7eba064cbd7336085953cce9

SHA1
79b458e4b5c974ce2361b103905a941eae0210b9

SHA256
2b6fb4f8615a821498deb27a55261d482fcf97a1dbe8143d233ee7d1b9b63dac

SHA512
420819a9aeeed54337aaabe2f4cf5f0f6b91cda6bacc5eae496320e2d22cc4eafccef7e38d4085d868ab28177889bcbf025f496c14b5df0384bc93ad14d591a6

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe

Filesize
14KB

MD5
60442812e48837950c4ae047287fe941

SHA1
948e0436a717ccc0eae4c29158d9053be32c238a

SHA256
01d53d4719a240e8de084b4eb1e5ba2721094d7a8c46d7c1850882f3fb90c54d

SHA512
626d41b2ca7b25ad247db87d9103099684e38d092302a1369ac5a5a070324642aef95dcf9b768eadd1554428fb1b7b92d1c34f6bde3f080b706d5c990c56bc63

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe

Filesize
14KB

MD5
60442812e48837950c4ae047287fe941

SHA1
948e0436a717ccc0eae4c29158d9053be32c238a

SHA256
01d53d4719a240e8de084b4eb1e5ba2721094d7a8c46d7c1850882f3fb90c54d

SHA512
626d41b2ca7b25ad247db87d9103099684e38d092302a1369ac5a5a070324642aef95dcf9b768eadd1554428fb1b7b92d1c34f6bde3f080b706d5c990c56bc63

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.exe.bat

Filesize
210B

MD5
4047f58017bce258debb606dce699c9d

SHA1
2d3f630ffcbe9ed924dccd0110e3ccf45f3a3eea

SHA256
57137bc7fb463801b4200be3115968117084ccc1641dfc43208c5484b0723924

SHA512
826eb64ca3e05c455058456d91bc7b6047b9aeed569dc8206a8353078d2c1404dc1acd4b31c15b25b71983cbda3a8cb00a43df1c3b38751e62affc76af563fcd

Download Submit
C:\Windows\20221002\efkki2NfQbIW5CsL\script\script.vbs

Filesize
74KB

MD5
9ecc1bef464dc50985e94bb61ea39481

SHA1
d322f77e54cc0e7111f4e894cb2bbe9e7afd0ff0

SHA256
b02a1d340606815f766afe59c6c7bd5e73b16954fa0c2f3489a00a49a5ab4f6a

SHA512
ae5bdd6aacb71e9b9b844d8a7fa01ac474c042d931d00cadfc6b51d1aa6346794a4fdb54aa844feed9b8024ac08de2958c7970f53d6bd816edf76c2916d5f2be

Download Submit
C:\Windows\AddRight.reg

Filesize
592B

MD5
53d75aea40be26a09d46f220accfb528

SHA1
82e1a094df1d4137697dfeb9f6b77b877d77ef8a

SHA256
a86cc1150a07bef8f91c426568651eae78be6af0ba06fc067014d6a9fb2c52c2

SHA512
1151e563503ef2841c8a052f0166565238fb86359ac4ded9939e77438e1efccc8d43d767e4dd59502dad4e0b38bf1bda7616254acbeb2b1ac07b2d30b0df3736

Download Submit
C:\Windows\MYShowIeLinkIe6.reg

Filesize
7KB

MD5
4f69fa82c34c91514da21a5933644af8

SHA1
e131f57f41ce95b46195d460852718b83517579a

SHA256
7cd8b741bfaee5cd14779b69d71b362aac4c928097c6b4af8ce0ce16bde52a46

SHA512
276588f960d28023febd87873c7852f401ab6ebfb3d90bf8b21b1998949d8ab00badb42d1a05934587aa6b4ad0ab06a3d649dcdb70f384ca70339049243463c4

Download Submit
C:\Windows\MyShowIeLinkIe7.reg

Filesize
9KB

MD5
dbd46bf2e72f6dfbb21295f4e3066d47

SHA1
cdd6ca2f6455c1e528c40a520bcdb8669df8f548

SHA256
71927f4f034db038385346e34209ad069139f54d73bae34bfaf4f29b7010fc6b

SHA512
ad013387a0c7608375b7a3c5fdb27f0d9e79b051d84b1ee9221346499f386d30473b5e2727f6a4e8a8122cf8ac2d473a5ce5e368e62da09441ed48e5c088bd11

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
150B

MD5
47164d66e9e797f434e044c04c25c426

SHA1
6f02c30481d3be2818beded681648dad820c5301

SHA256
f4d2c4b1fae364577058aa39fde412f70cc05e4ce232d565224f95f5a5f06926

SHA512
9acdc9fa4ace438873745d88bd758c7c20e8a260fee81171ee193375954608f9b8c5cea9d6ddf41147b5a2bc8f5477db58c1f16d290bd31eca41736344837c37

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
150B

MD5
47164d66e9e797f434e044c04c25c426

SHA1
6f02c30481d3be2818beded681648dad820c5301

SHA256
f4d2c4b1fae364577058aa39fde412f70cc05e4ce232d565224f95f5a5f06926

SHA512
9acdc9fa4ace438873745d88bd758c7c20e8a260fee81171ee193375954608f9b8c5cea9d6ddf41147b5a2bc8f5477db58c1f16d290bd31eca41736344837c37

Download Submit
C:\Windows\SysWOW64\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\SysWOW64\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\search.reg

Filesize
1KB

MD5
8e2ec860bfbd9aa37ea44e51d559ea9b

SHA1
f64e2891ec34d4909f28b2ae14c0a9f712a0e29c

SHA256
ff8d92c2bbe81ccfa1a6ac46ac66e7b42dc4fd18a27924c2e6511d2579f092df

SHA512
ad551272a90d79aef258d22680c07a5d81b0b31e1712dc2a60ac2c67f8af13f18c3a5f99f8408231bc5bb4f68882a5d75ed5c0e203059575eea5940d8b841dc1

Download Submit
C:\Windows\userid.txt

Filesize
4B

MD5
e702e51da2c0f5be4dd354bb3e295d37

SHA1
bf5ce6bca1837184b86a1fb332edb735665ca1ed

SHA256
f8726da5732fa9095e0129c6c25619a35d435aa39e17a15998fa87ee96d34aeb

SHA512
6609b272fbd5c1710ac6311e49232ac188ade52707868acd29f51302c92939b8bd47901966ee0076aad312257d75a47c06ba419eb3201fee93c6e55c08f814c3

Download Submit
memory/228-150-0x0000000000000000-mapping.dmp

Download
memory/228-217-0x0000000000000000-mapping.dmp

Download
memory/396-198-0x0000000000000000-mapping.dmp

Download
memory/416-177-0x0000000000000000-mapping.dmp

Download
memory/444-180-0x0000000000000000-mapping.dmp

Download
memory/672-178-0x0000000000000000-mapping.dmp

Download
memory/712-211-0x0000000000000000-mapping.dmp

Download
memory/740-192-0x0000000000000000-mapping.dmp

Download
memory/876-133-0x0000000000000000-mapping.dmp

Download
memory/1008-225-0x0000000000000000-mapping.dmp

Download
memory/1016-210-0x0000000000000000-mapping.dmp

Download
memory/1248-165-0x0000000000000000-mapping.dmp

Download
memory/1252-146-0x0000000000000000-mapping.dmp

Download
memory/1512-199-0x0000000000000000-mapping.dmp

Download
memory/1688-144-0x0000000000000000-mapping.dmp

Download
memory/1792-172-0x0000000000000000-mapping.dmp

Download
memory/1924-209-0x0000000000000000-mapping.dmp

Download
memory/1940-152-0x0000000000000000-mapping.dmp

Download
memory/1952-171-0x0000000000000000-mapping.dmp

Download
memory/1952-201-0x0000000000000000-mapping.dmp

Download
memory/2000-191-0x0000000000000000-mapping.dmp

Download
memory/2004-223-0x0000000000000000-mapping.dmp

Download
memory/2020-168-0x0000000000000000-mapping.dmp

Download
memory/2116-219-0x0000000000000000-mapping.dmp

Download
memory/2128-141-0x0000000000000000-mapping.dmp

Download
memory/2160-174-0x0000000000000000-mapping.dmp

Download
memory/2268-173-0x0000000000000000-mapping.dmp

Download
memory/2320-166-0x0000000000000000-mapping.dmp

Download
memory/2408-214-0x0000000000000000-mapping.dmp

Download
memory/2500-200-0x0000000000000000-mapping.dmp

Download
memory/2560-197-0x0000000000000000-mapping.dmp

Download
memory/2608-208-0x0000000000000000-mapping.dmp

Download
memory/3132-221-0x0000000000000000-mapping.dmp

Download
memory/3132-175-0x0000000000000000-mapping.dmp

Download
memory/3208-196-0x0000000000000000-mapping.dmp

Download
memory/3216-202-0x0000000000000000-mapping.dmp

Download
memory/3268-132-0x0000000000000000-mapping.dmp

Download
memory/3416-176-0x0000000000000000-mapping.dmp

Download
memory/3584-187-0x0000000000000000-mapping.dmp

Download
memory/3760-155-0x0000000000000000-mapping.dmp

Download
memory/3788-148-0x0000000000000000-mapping.dmp

Download
memory/3812-205-0x0000000000000000-mapping.dmp

Download
memory/3932-181-0x0000000000000000-mapping.dmp

Download
memory/3944-179-0x0000000000000000-mapping.dmp

Download
memory/3952-156-0x0000000000000000-mapping.dmp

Download
memory/4248-157-0x0000000000000000-mapping.dmp

Download
memory/4264-195-0x0000000000000000-mapping.dmp

Download
memory/4292-190-0x0000000000000000-mapping.dmp

Download
memory/4416-194-0x0000000000000000-mapping.dmp

Download
memory/4468-188-0x0000000000000000-mapping.dmp

Download
memory/4600-207-0x0000000000000000-mapping.dmp

Download
memory/4612-169-0x0000000000000000-mapping.dmp

Download
memory/4620-139-0x0000000000000000-mapping.dmp

Download
memory/4648-189-0x0000000000000000-mapping.dmp

Download
memory/4704-184-0x0000000000000000-mapping.dmp

Download
memory/4752-135-0x0000000000000000-mapping.dmp

Download
memory/4816-182-0x0000000000000000-mapping.dmp

Download
memory/4816-213-0x0000000000000000-mapping.dmp

Download
memory/4820-186-0x0000000000000000-mapping.dmp

Download
memory/4832-185-0x0000000000000000-mapping.dmp

Download
memory/4992-206-0x0000000000000000-mapping.dmp

Download
memory/5016-203-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads