6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe
Size

148KB
MD5

199b8de05c4710457a31dd15815747d6
SHA1

b1b9a732c12aca82178c7ed742a752a949b78b98
SHA256

6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579
SHA512

73f72c8556aa85710bc7f46ac37edfc71cec1dc8df49d35b7852126bee3de613705ca36c88302d2c3aa75a5244a390e6c2130286dce0bbd875d09585c97699a3
SSDEEP

3072:KX5H3oUhFBpQhvrHQc5LDUUn1Ir/sFdhq4r:KpH3oUhahvrHQc5LNIrezq4r

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3084	822tc5ndIk2kiJT.exe
4736	script.exe
2860	smss.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	822tc5ndIk2kiJT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4020	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\flashget = "c:\\windows\\20221021\\cx55v8luq52mdaf8\\smss.exe "	reg.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regedit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\XlKankan.dll	822tc5ndIk2kiJT.exe
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe.bat	822tc5ndIk2kiJT.exe
File opened for modification	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\regBHO.reg	822tc5ndIk2kiJT.exe
File created	C:\Windows\tao.ico	822tc5ndIk2kiJT.exe
File created	C:\Windows\userid.txt	script.exe
File created	C:\Windows\MYShowIeLinkIe6.reg	WScript.exe
File created	C:\Windows\MyShowIeLinkIe7.reg	WScript.exe
File created	C:\Windows\juhoab.vbs	WScript.exe
File created	C:\Windows\AddRight.reg	WScript.exe
File created	C:\Windows\Survival_0.txt	smss.exe
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe	822tc5ndIk2kiJT.exe
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\script.vbs	822tc5ndIk2kiJT.exe
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\reg.bat	822tc5ndIk2kiJT.exe
File created	C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe	822tc5ndIk2kiJT.exe
File created	C:\Windows\20221021\25J5X8iB85J2emsC\script\Script.vbs.bat	script.exe
File opened for modification	C:\Windows\SysWOW64	xcopy.exe
File created	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\.reg	WScript.exe
File created	C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe.bat	822tc5ndIk2kiJT.exe
File created	C:\Windows\search.reg	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000030000002003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000030000000140000002a000000010000008006000080010000030000008102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\DisplayName = "°Ù¶ÈÒ»ÏÂ£¬Äã¾ÍÖªµÀ"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Explorer\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/baidu.htm"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c0000000000000468100000010000000feb8496527bbc90112c0b16e27bbc9015aac066827bbc9010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008c3acb231000444f43554d457e310000440003000400efbe8c3ada218c3acb231400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a003100000000008c3acc23100041444d494e497e310000320003000400efbe8c3acb238c3acc2314000000410064006d0069006e006900730074007200610074006f0072000000180056003100000000008c3ace2311004641564f52497e3100003e0003000400efbe8c3acb238c3ace23140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d313236393300180030003500000000008c3acf231000fe94a56300001c0003000400efbe8c3acc238c3acf2314000000fe94a56300001400000060000000030000a0580000000000000067686f73747870332d3436373638300008fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa208fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa200000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\URL = "http://www.mylovewebs.com/api/baidu/so.htm?word={searchTerms}"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\SortIndex = "2"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconURL = "http://www.taobao.com/favicon.ico"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006200000001000000a0060000a00f000005000000220400002600000002000000a10600006001000004000000a1000000c600000003000000a1020000d4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\DisplayName = "ÌÔ±¦ËÑË÷"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{F2CF5485-4E02-4F68-819C-B92DE9277049} = 8554cff2024e684f819cb92de927704922001c000800000006000000010000000000000000000000000000004c0000000114020000000000c000000000000046810000001000000010a155c0ffe9ca0118bf0ffd11edca0118bf0ffd11edca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008e3ab9151000444f43554d457e310000440003000400efbe8c3ada21a23c2c701400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a53c0586100041444d494e497e310000320003000400efbe8c3acb23a53c058614000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a23c809611004641564f52497e3100003e0003000400efbea23c0070a23c8096140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a63ce45d1000fe94a56300001c0003000400efbea23c0070a63ce45d14000000fe94a56300001400000060000000030000a058000000000000007063323031303035303232317663620008fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824608fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824600000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}.ico"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000340000001b000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{E140FB5B-2A9D-4FA4-A20F-089B92412200}.ico"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\SortIndex = "6"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/google.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 65cf80b551e1c349b73f70b13fca8e86	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\SearchScopes	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/index.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\URL = "http://www.mylovewebs.com/api/taobao/so.htm?word={searchTerms}"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/youdao.htm"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\LinksFolderName = "Á´½Ó"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c00000000000004681000000100000009ed10ec233ecca01e61abf65c5edca019ed10ec233ecca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c00310000000000a53c284a1000444f43554d457e310000440003000400efbea53c1249a73cf1481400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a63c8e0c100041444d494e497e310000320003000400efbea53c284aa73cf14814000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a63c760f11004641564f52497e3100003e0003000400efbea53c284aa73c3344140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a53c294a1000fe94a56300001c0003000400efbea53c294aa73c334414000000fe94a56300001400000060000000030000a0580000000000000068792d3636796c7032363264663675000ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e00026180888870ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e000261808888700000000	regedit.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1274"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1274"	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR\ = "C:\\Windows\\System32"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ProgID\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shdocvw.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "AllTypes"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.txt = "txtfile"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.ini = "inifile"	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\ = "´ò¿ªÖ÷Ò³(&H)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\ = "QvodAdBlocker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\Attributes = 00000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command\ = "\"C:\\Windows\\20221021\\25J5X8iB85J2emsC\\script\\script.exe\" \"%1\""	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\Clsid\ = "{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command\ = "Rundll32.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.zaodezhu.com/?my=1274"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command	regedit.exe

Runs .reg file with regedit 8 IoCs

pid	Process
4152	regedit.exe
4984	regedit.exe
2720	regedit.exe
644	regedit.exe
3120	regedit.exe
3804	regedit.exe
3396	regedit.exe
1524	regedit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2860	smss.exe
2860	smss.exe
2860	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3076	1344	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe	83
PID 1344 wrote to memory of 3076	1344	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe	83
PID 1344 wrote to memory of 3076	1344	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe	83
PID 1344 wrote to memory of 1284	1344	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe	85
PID 1344 wrote to memory of 1284	1344	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe	85
PID 1344 wrote to memory of 1284	1344	6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe	85
PID 3076 wrote to memory of 3084	3076	cmd.exe	87
PID 3076 wrote to memory of 3084	3076	cmd.exe	87
PID 3076 wrote to memory of 3084	3076	cmd.exe	87
PID 3084 wrote to memory of 4268	3084	822tc5ndIk2kiJT.exe	88
PID 3084 wrote to memory of 4268	3084	822tc5ndIk2kiJT.exe	88
PID 3084 wrote to memory of 4268	3084	822tc5ndIk2kiJT.exe	88
PID 4268 wrote to memory of 4736	4268	cmd.exe	90
PID 4268 wrote to memory of 4736	4268	cmd.exe	90
PID 4268 wrote to memory of 4736	4268	cmd.exe	90
PID 4736 wrote to memory of 4636	4736	script.exe	91
PID 4736 wrote to memory of 4636	4736	script.exe	91
PID 4736 wrote to memory of 4636	4736	script.exe	91
PID 4736 wrote to memory of 4484	4736	script.exe	93
PID 4736 wrote to memory of 4484	4736	script.exe	93
PID 4736 wrote to memory of 4484	4736	script.exe	93
PID 4484 wrote to memory of 1176	4484	cmd.exe	95
PID 4484 wrote to memory of 1176	4484	cmd.exe	95
PID 4484 wrote to memory of 1176	4484	cmd.exe	95
PID 4484 wrote to memory of 3396	4484	cmd.exe	96
PID 4484 wrote to memory of 3396	4484	cmd.exe	96
PID 4484 wrote to memory of 3396	4484	cmd.exe	96
PID 4484 wrote to memory of 4020	4484	cmd.exe	97
PID 4484 wrote to memory of 4020	4484	cmd.exe	97
PID 4484 wrote to memory of 4020	4484	cmd.exe	97
PID 4636 wrote to memory of 3392	4636	cmd.exe	98
PID 4636 wrote to memory of 3392	4636	cmd.exe	98
PID 4636 wrote to memory of 3392	4636	cmd.exe	98
PID 3392 wrote to memory of 3032	3392	WScript.exe	100
PID 3392 wrote to memory of 3032	3392	WScript.exe	100
PID 3392 wrote to memory of 3032	3392	WScript.exe	100
PID 3392 wrote to memory of 4732	3392	WScript.exe	102
PID 3392 wrote to memory of 4732	3392	WScript.exe	102
PID 3392 wrote to memory of 4732	3392	WScript.exe	102
PID 3392 wrote to memory of 4576	3392	WScript.exe	104
PID 3392 wrote to memory of 4576	3392	WScript.exe	104
PID 3392 wrote to memory of 4576	3392	WScript.exe	104
PID 3392 wrote to memory of 5100	3392	WScript.exe	106
PID 3392 wrote to memory of 5100	3392	WScript.exe	106
PID 3392 wrote to memory of 5100	3392	WScript.exe	106
PID 3392 wrote to memory of 4412	3392	WScript.exe	108
PID 3392 wrote to memory of 4412	3392	WScript.exe	108
PID 3392 wrote to memory of 4412	3392	WScript.exe	108
PID 3392 wrote to memory of 1788	3392	WScript.exe	110
PID 3392 wrote to memory of 1788	3392	WScript.exe	110
PID 3392 wrote to memory of 1788	3392	WScript.exe	110
PID 3392 wrote to memory of 4288	3392	WScript.exe	112
PID 3392 wrote to memory of 4288	3392	WScript.exe	112
PID 3392 wrote to memory of 4288	3392	WScript.exe	112
PID 3392 wrote to memory of 1484	3392	WScript.exe	114
PID 3392 wrote to memory of 1484	3392	WScript.exe	114
PID 3392 wrote to memory of 1484	3392	WScript.exe	114
PID 3392 wrote to memory of 2936	3392	WScript.exe	116
PID 3392 wrote to memory of 2936	3392	WScript.exe	116
PID 3392 wrote to memory of 2936	3392	WScript.exe	116
PID 3392 wrote to memory of 3832	3392	WScript.exe	178
PID 3392 wrote to memory of 3832	3392	WScript.exe	178
PID 3392 wrote to memory of 3832	3392	WScript.exe	178
PID 3392 wrote to memory of 4548	3392	WScript.exe	120

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4548	attrib.exe
3060	attrib.exe
4212	attrib.exe
3032	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe
"C:\Users\Admin\AppData\Local\Temp\6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe
    "C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe
        
        "C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\20221021\25J5X8iB85J2emsC\script\Script.vbs.bat" "
        6⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\20221021\25J5X8iB85J2emsC\script\script.vbs"
        7⤵
        Checks computer location settings
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:3032
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrators
        8⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c Administrators:CI
        8⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrator
        8⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r users
        8⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r system
        8⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r everyone
        8⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r user
        8⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Power Users"
        8⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Admin"
        8⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:4548
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrators
        8⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c Administrators:CI
        8⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrator
        8⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r users
        8⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r system
        8⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r everyone
        8⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r user
        8⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Power Users"
        8⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Admin"
        8⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:3060
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrators
        8⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c Administrators:CI
        8⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrator
        8⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r users
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r system
        8⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r everyone
        8⤵
        
        PID:344
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r user
        8⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Power Users"
        8⤵
        
        PID:832
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Admin"
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:4212
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r Administrators
        8⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c Administrators:CI
        8⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r Administrator
        8⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r users
        8⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r system
        8⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r everyone
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r user
        8⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r "Power Users"
        8⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt" /e /c /r "Admin"
        8⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
        8⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Runs .reg file with regedit
        
        PID:1524
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\MYShowIeLinkIe6.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:4152
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\MyShowIeLinkIe7.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:4984
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\search.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:2720
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\.reg
        8⤵
        Modifies registry class
        Runs .reg file with regedit
        
        PID:644
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\AddRight.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:3120
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
        8⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Runs .reg file with regedit
        
        PID:3804
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\20221021\25J5X8iB85J2emsC\script\reg.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /c /q /y /i XlKankan.dll C:\Windows\system32
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Enumerates system info in registry
        
        PID:1176
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regBHO.reg
        7⤵
        Installs/modifies Browser Helper Object
        Runs .reg file with regedit
        
        PID:3396
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s XlKankan.dll
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe.bat" "
      4⤵
      PID:1936
    - - C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe
        
        "C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "flashget" /d "c:\windows\20221021\cx55v8luq52mdaf8\smss.exe " /f
        6⤵
        Adds Run key to start application
        
        PID:3936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe.bat" "
      4⤵
      PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe.bat" "
  2⤵
  PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Admin\AppData\Local\Temp\6829aa1070f348f06d6e886448338ccaabb6b6cc147400e0a682ddfd9e3d8579.exe.bat

Filesize
525B

MD5
f4af7e411be23983b2a8f165ce4a0abf

SHA1
cb941596246e98975669a21a9c49a7adb14f5f4f

SHA256
c70e687646381038c57e9d1e9b87aee46b1dbfe7f01444e35ab54e396b421e0b

SHA512
3b8d595340f61e9fce92ebb5907c502ef4743119beecfc37aeac9a2161c0da966e8d2606fe2e8fa8738203ab03c11d59a7408f150538e72d3501fc8501aacdf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe

Filesize
111KB

MD5
fa1c8c4a83913e8639ac4227231f7ad1

SHA1
a415cfc290360a5c76a00759a6c055f0d7c27194

SHA256
f078e063e32f521d16a7cb253099de14ed7f52c0882058734bfb47caf9b1a07b

SHA512
dbd0278f51738033f2934d9039acbb980ecacb50bcea6710c1419206349e76a919455af00f91059c4b2694de46fb1c483d39e7bd191cf36a3ceffdf124157ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe

Filesize
111KB

MD5
fa1c8c4a83913e8639ac4227231f7ad1

SHA1
a415cfc290360a5c76a00759a6c055f0d7c27194

SHA256
f078e063e32f521d16a7cb253099de14ed7f52c0882058734bfb47caf9b1a07b

SHA512
dbd0278f51738033f2934d9039acbb980ecacb50bcea6710c1419206349e76a919455af00f91059c4b2694de46fb1c483d39e7bd191cf36a3ceffdf124157ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe.bat

Filesize
329B

MD5
9857f7d7c590080e5e748497f739d837

SHA1
5923555dd4690edf137742ae6a81f8b4054224e5

SHA256
1e7d05724a47e27629c568b47aaddeddc1baf4b2788c92480fecd23cd5bbf3d0

SHA512
f0494b396c43992bea6973ab13cc4871bd799ff43f3bf5a582ffc72b8dba1896e34b77909df633e9090974d0dce7bf083b1eb899e01e348043a1750d0bac769a

Download Submit
C:\Users\Admin\AppData\Local\Temp\822tc5ndIk2kiJT.exe.bat

Filesize
207B

MD5
612be96cf16eb5f415bc8f5b8c724389

SHA1
a20cb0212da2ee4e9c86a7133c7e66606ed80d0d

SHA256
32bea251cc64c53024689b0d90d8ee416bd3c2857222e22c4905b4055a4694ab

SHA512
6a260ba4926a7d85ea46fa8155cf36983efef88f3b17cd9aebaa9d76d355f5fec16bd2a1b9577ea47ecd6f2c2c2e0a9303ec5e411e289b8f3d9a22f7bdbd19d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Public\Desktop\Internet Explorer.tt

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Public\Desktop\ÌØ¼Û¹ºÎï.bt

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Windows\.reg

Filesize
1KB

MD5
65bf25de434a6cfb78b5cd949957ab62

SHA1
738fed948972912548fddce4a763d4c4ff94ee05

SHA256
0c9ebb8044661c0824d7e4fd3b6462b6671a5bff1185e3ffd8b151322aa6b43d

SHA512
377fd8318f762b153bb2ccb5f08504cb9a9ac38cf754ed7cf03dd3ea67a244c6c342700fdc387c7cf684f177a65bd5b2f2c73dc7925bd454135609b4f67ddaeb

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\Script.vbs.bat

Filesize
210B

MD5
e3209067bf227615880176af0ba950e6

SHA1
fbd77831fc94d857a24ecc5740a976c3f9de3fd0

SHA256
08d7b9616efd2629cf1ee4743459ae3637708bb6cbd6aab15651edfdf6b85689

SHA512
4201db321581f09f64bb1fd8a7c8b4f900a7f44a6bbdb59c4594e3814376c3d331b0c25667d4168b1ecab0f9566493f743a6380e94c84c5c372640bee1113292

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\reg.bat

Filesize
130B

MD5
d426a1646ddadd0e41ff5358eeceb3c4

SHA1
69e585d10ad1f4d03a4ceec7f4e336951e10406f

SHA256
86861d7856b53976d754875343237f55e63ca5580db3e57f6ffbbc86977ef573

SHA512
401c3aa8a1a426cb7c6fdfc0e0cd5da193abb8c44c17143996e57838060f22601c51fc3a3da915d0ac3a3f7a70a217fa9576c575bc9f5a30b542c9a5a206dd97

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\regBHO.reg

Filesize
356B

MD5
b93db4ec7eba064cbd7336085953cce9

SHA1
79b458e4b5c974ce2361b103905a941eae0210b9

SHA256
2b6fb4f8615a821498deb27a55261d482fcf97a1dbe8143d233ee7d1b9b63dac

SHA512
420819a9aeeed54337aaabe2f4cf5f0f6b91cda6bacc5eae496320e2d22cc4eafccef7e38d4085d868ab28177889bcbf025f496c14b5df0384bc93ad14d591a6

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe

Filesize
14KB

MD5
60442812e48837950c4ae047287fe941

SHA1
948e0436a717ccc0eae4c29158d9053be32c238a

SHA256
01d53d4719a240e8de084b4eb1e5ba2721094d7a8c46d7c1850882f3fb90c54d

SHA512
626d41b2ca7b25ad247db87d9103099684e38d092302a1369ac5a5a070324642aef95dcf9b768eadd1554428fb1b7b92d1c34f6bde3f080b706d5c990c56bc63

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe

Filesize
14KB

MD5
60442812e48837950c4ae047287fe941

SHA1
948e0436a717ccc0eae4c29158d9053be32c238a

SHA256
01d53d4719a240e8de084b4eb1e5ba2721094d7a8c46d7c1850882f3fb90c54d

SHA512
626d41b2ca7b25ad247db87d9103099684e38d092302a1369ac5a5a070324642aef95dcf9b768eadd1554428fb1b7b92d1c34f6bde3f080b706d5c990c56bc63

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\script.exe.bat

Filesize
210B

MD5
fd7f1c35287630b438b3ebbede74bbca

SHA1
112428b70068fb1461ed0b9f9390a6fac119acde

SHA256
e073a19b2afbfc7c1b229cb4e1a3cfa9d3aca105b3771194a6ae69d0c9230bbe

SHA512
3bb135d7c6a86265331da81852f3dfc59616ec007af7e1059f4b42cf7752b75acee9b49665b9544ed6b522c2be744d4c20f7daaad25ae652a9e475fff76aa44f

Download Submit
C:\Windows\20221021\25J5X8iB85J2emsC\script\script.vbs

Filesize
74KB

MD5
9ecc1bef464dc50985e94bb61ea39481

SHA1
d322f77e54cc0e7111f4e894cb2bbe9e7afd0ff0

SHA256
b02a1d340606815f766afe59c6c7bd5e73b16954fa0c2f3489a00a49a5ab4f6a

SHA512
ae5bdd6aacb71e9b9b844d8a7fa01ac474c042d931d00cadfc6b51d1aa6346794a4fdb54aa844feed9b8024ac08de2958c7970f53d6bd816edf76c2916d5f2be

Download Submit
C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe

Filesize
16.1MB

MD5
9d23c9d50738658d0fe13a6cd1b9fdb6

SHA1
20073eca652bdf4f26c0bf1c6cd395e3a55234d8

SHA256
8763c04d627c8b294a487a9398b14df8d5bfb46a1e819c613ac59b491e6e471c

SHA512
198303c5126ec285872127f6a97367e97bdbade092187731d6ec5acb4577d46d556cb9c057e8ec3f25442cd16a2bd381d5ee5b426e95a50c2be356063da47d1a

Download Submit
C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe

Filesize
16.1MB

MD5
9d23c9d50738658d0fe13a6cd1b9fdb6

SHA1
20073eca652bdf4f26c0bf1c6cd395e3a55234d8

SHA256
8763c04d627c8b294a487a9398b14df8d5bfb46a1e819c613ac59b491e6e471c

SHA512
198303c5126ec285872127f6a97367e97bdbade092187731d6ec5acb4577d46d556cb9c057e8ec3f25442cd16a2bd381d5ee5b426e95a50c2be356063da47d1a

Download Submit
C:\Windows\20221021\cX55V8LUQ52mDAF8\smss.exe.bat

Filesize
183B

MD5
87ee326f1edfb61e77348c7336707ce5

SHA1
6c37e65ec3d8da19621e32e4ae9921ad6cf3608f

SHA256
a67935e6318772bee7fd3a7c1d7fd3b666f897ab7d8d1a18944172efc24d8ab0

SHA512
b6b67b70f5fcf227c3b255f0afb7d6a3efff88abac4eceeda45bcb790969e0791b71d8b738ddc076930ab8174d9007f5b093bcd7849c26fb450e3612149ab90d

Download Submit
C:\Windows\AddRight.reg

Filesize
592B

MD5
53d75aea40be26a09d46f220accfb528

SHA1
82e1a094df1d4137697dfeb9f6b77b877d77ef8a

SHA256
a86cc1150a07bef8f91c426568651eae78be6af0ba06fc067014d6a9fb2c52c2

SHA512
1151e563503ef2841c8a052f0166565238fb86359ac4ded9939e77438e1efccc8d43d767e4dd59502dad4e0b38bf1bda7616254acbeb2b1ac07b2d30b0df3736

Download Submit
C:\Windows\MYShowIeLinkIe6.reg

Filesize
7KB

MD5
4f69fa82c34c91514da21a5933644af8

SHA1
e131f57f41ce95b46195d460852718b83517579a

SHA256
7cd8b741bfaee5cd14779b69d71b362aac4c928097c6b4af8ce0ce16bde52a46

SHA512
276588f960d28023febd87873c7852f401ab6ebfb3d90bf8b21b1998949d8ab00badb42d1a05934587aa6b4ad0ab06a3d649dcdb70f384ca70339049243463c4

Download Submit
C:\Windows\MyShowIeLinkIe7.reg

Filesize
9KB

MD5
dbd46bf2e72f6dfbb21295f4e3066d47

SHA1
cdd6ca2f6455c1e528c40a520bcdb8669df8f548

SHA256
71927f4f034db038385346e34209ad069139f54d73bae34bfaf4f29b7010fc6b

SHA512
ad013387a0c7608375b7a3c5fdb27f0d9e79b051d84b1ee9221346499f386d30473b5e2727f6a4e8a8122cf8ac2d473a5ce5e368e62da09441ed48e5c088bd11

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
150B

MD5
47164d66e9e797f434e044c04c25c426

SHA1
6f02c30481d3be2818beded681648dad820c5301

SHA256
f4d2c4b1fae364577058aa39fde412f70cc05e4ce232d565224f95f5a5f06926

SHA512
9acdc9fa4ace438873745d88bd758c7c20e8a260fee81171ee193375954608f9b8c5cea9d6ddf41147b5a2bc8f5477db58c1f16d290bd31eca41736344837c37

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
150B

MD5
47164d66e9e797f434e044c04c25c426

SHA1
6f02c30481d3be2818beded681648dad820c5301

SHA256
f4d2c4b1fae364577058aa39fde412f70cc05e4ce232d565224f95f5a5f06926

SHA512
9acdc9fa4ace438873745d88bd758c7c20e8a260fee81171ee193375954608f9b8c5cea9d6ddf41147b5a2bc8f5477db58c1f16d290bd31eca41736344837c37

Download Submit
C:\Windows\SysWOW64\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\SysWOW64\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\search.reg

Filesize
1KB

MD5
8e2ec860bfbd9aa37ea44e51d559ea9b

SHA1
f64e2891ec34d4909f28b2ae14c0a9f712a0e29c

SHA256
ff8d92c2bbe81ccfa1a6ac46ac66e7b42dc4fd18a27924c2e6511d2579f092df

SHA512
ad551272a90d79aef258d22680c07a5d81b0b31e1712dc2a60ac2c67f8af13f18c3a5f99f8408231bc5bb4f68882a5d75ed5c0e203059575eea5940d8b841dc1

Download Submit
C:\Windows\userid.txt

Filesize
4B

MD5
e702e51da2c0f5be4dd354bb3e295d37

SHA1
bf5ce6bca1837184b86a1fb332edb735665ca1ed

SHA256
f8726da5732fa9095e0129c6c25619a35d435aa39e17a15998fa87ee96d34aeb

SHA512
6609b272fbd5c1710ac6311e49232ac188ade52707868acd29f51302c92939b8bd47901966ee0076aad312257d75a47c06ba419eb3201fee93c6e55c08f814c3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads