sality | 36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51

Modify Existing Service

T1031

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

Modify Registry

Change Default File Association

T1042

Processes:

360safe.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Safe360Ext\ = "{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Safe360Ext\ = "{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SoftMgrExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SoftMgrExt\ = "{5E19C0CE-C02C-46c2-98C3-A2E12EDE0E17}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Safe360Ext	360safe.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Program Files (x86)\360\360Safe\deepscan\cloudcom2.dll	cryptone

Downloads MZ/PE file

Drops file in Drivers directory 11 IoCs

Processes:

360safe.exe360tray.exezhudongfangyu.exe

description	ioc	process
File created	C:\Windows\system32\drivers\360Camera64.sys	360safe.exe
File created	C:\Windows\system32\drivers\BAPIDRV64.SYS	360safe.exe
File created	C:\Windows\system32\drivers\efimon.sys	360safe.exe
File created	C:\Windows\system32\drivers\efimon.sys	360tray.exe
File created	C:\Windows\system32\drivers\360netmon.sys	360safe.exe
File created	C:\Windows\system32\drivers\360Box64.sys	360safe.exe
File opened for modification	C:\Windows\system32\drivers\360FsFlt.sys	zhudongfangyu.exe
File created	C:\Windows\system32\drivers\efimon.sys	zhudongfangyu.exe
File created	C:\Windows\system32\drivers\360LanProtect.sys	360safe.exe
File created	C:\Windows\system32\drivers\360AntiHacker64.sys	360safe.exe
File created	C:\Windows\system32\drivers\360FsFlt.sys	zhudongfangyu.exe

Executes dropped EXE 9 IoCs

Processes:

360safe.exezhudongfangyu.exezhudongfangyu.exewsccontrol.exe360tray.exe360tray.exe360entcall.exeSoftupNotify.exeSoftMgrProxy64.exe

pid	process
3720	360safe.exe
4536	zhudongfangyu.exe
3476	zhudongfangyu.exe
2780	wsccontrol.exe
2564	360tray.exe
3348	360tray.exe
5084	360entcall.exe
1460	SoftupNotify.exe
4784	SoftMgrProxy64.exe

Registers COM server for autorun 1 TTPs 64 IoCs

Registry Run Keys / Startup Folder

Processes:

360safe.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{78A1990F-7561-4CB9-A8BF-B6CCF8AAEB97}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{26CD0715-0722-479B-A8C7-29A911171774}\InProcServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\Utils\\shell360ext64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12793398-A212-446F-BA1E-1F1B5ABDB89C}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E715FE74-087F-4F4C-BB0A-0245C8A897E2}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63A39D0C-0B63-49EE-BB21-D106ED548C51}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEE8C32E-C785-4B1F-A33B-FCD6942418BD}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06F2A2CA-E0E2-47D7-A3EC-29FD090E7F86}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E431A037-AE60-4D57-99D7-B402223AE8A0}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\Utils\\shell360ext64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6BC477E-2646-459A-9D6A-75902C24430D}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0B3184D-90C8-4F4D-B19A-42B6C659378B}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{056A6FBD-8148-443A-AAB2-DB3C46B1F083}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{26CD0715-0722-479B-A8C7-29A911171774}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEE8C32E-C785-4B1F-A33B-FCD6942418BD}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E19C0CE-C02C-46c2-98C3-A2E12EDE0E17}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\SoftMgr\\SoftMgrExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12793398-A212-446F-BA1E-1F1B5ABDB89C}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6BC477E-2646-459A-9D6A-75902C24430D}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9A94B6A-60FB-4A19-8BA3-4A2068F1026D}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A650B6F-1548-4294-AB07-F17604108156}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E19C0CE-C02C-46c2-98C3-A2E12EDE0E17}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12793398-A212-446F-BA1E-1F1B5ABDB89C}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A650B6F-1548-4294-AB07-F17604108156}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06F2A2CA-E0E2-47D7-A3EC-29FD090E7F86}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{78A1990F-7561-4CB9-A8BF-B6CCF8AAEB97}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63A39D0C-0B63-49EE-BB21-D106ED548C51}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E19C0CE-C02C-46c2-98C3-A2E12EDE0E17}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A06468-8A7C-4EFA-A61C-9C0E911194C9}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE3F69E2-3085-4C46-B050-A45F008827D6}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe

Sets service image path in registry 2 TTPs 8 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

360safe.exezhudongfangyu.exezhudongfangyu.exe360tray.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360Box64\ImagePath = "system32\\DRIVERS\\360Box64.sys"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ZhuDongFangYu\ImagePath = "\"C:\\Program Files (x86)\\360\\360Safe\\deepscan\\zhudongfangyu.exe\""	zhudongfangyu.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BAPIDRV\ImagePath = "\\SystemRoot\\System32\\Drivers\\BAPIDRV64.SYS"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys"	zhudongfangyu.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BAPIDRV\ImagePath = "\\SystemRoot\\System32\\Drivers\\BAPIDRV64.SYS"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AntiHacker\ImagePath = "System32\\Drivers\\360AntiHacker64.sys"	360tray.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4316-132-0x0000000002420000-0x00000000034AE000-memory.dmp	upx
behavioral2/memory/4316-135-0x0000000002420000-0x00000000034AE000-memory.dmp	upx
behavioral2/memory/4316-136-0x0000000002420000-0x00000000034AE000-memory.dmp	upx
behavioral2/memory/4316-299-0x0000000002420000-0x00000000034AE000-memory.dmp	upx

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

Processes:

360safe.exe360tray.exeSoftupNotify.exe360tray.exe36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	360safe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	360tray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SoftupNotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	360tray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Loads dropped DLL 64 IoCs

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe360safe.exeregsvr32.exezhudongfangyu.exezhudongfangyu.exe360tray.exe360tray.exe360entcall.exeSoftupNotify.exe

pid	process
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
1852	regsvr32.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
4536	zhudongfangyu.exe
4536	zhudongfangyu.exe
4536	zhudongfangyu.exe
3476	zhudongfangyu.exe
3476	zhudongfangyu.exe
3476	zhudongfangyu.exe
3476	zhudongfangyu.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3476	zhudongfangyu.exe
3476	zhudongfangyu.exe
3720	360safe.exe
3720	360safe.exe
3476	zhudongfangyu.exe
3476	zhudongfangyu.exe
3476	zhudongfangyu.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
3720	360safe.exe
2564	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
5084	360entcall.exe
5084	360entcall.exe
3348	360tray.exe
3348	360tray.exe
5084	360entcall.exe
3348	360tray.exe
3348	360tray.exe
5084	360entcall.exe
5084	360entcall.exe
3348	360tray.exe
3348	360tray.exe
1460	SoftupNotify.exe
1460	SoftupNotify.exe

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

360safe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360Safetray = "\"C:\\Program Files (x86)\\360\\360Safe\\safemon\\360Tray.exe\" /start"	360safe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

360tray.exe36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
File opened (read-only)	\??\v:	360tray.exe
File opened (read-only)	\??\l:	360tray.exe
File opened (read-only)	\??\N:	360tray.exe
File opened (read-only)	\??\T:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\u:	360tray.exe
File opened (read-only)	\??\J:	360tray.exe
File opened (read-only)	\??\Y:	360tray.exe
File opened (read-only)	\??\M:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\W:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\f:	360tray.exe
File opened (read-only)	\??\K:	360tray.exe
File opened (read-only)	\??\T:	360tray.exe
File opened (read-only)	\??\W:	360tray.exe
File opened (read-only)	\??\J:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\p:	360tray.exe
File opened (read-only)	\??\U:	360tray.exe
File opened (read-only)	\??\X:	360tray.exe
File opened (read-only)	\??\K:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\X:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\e:	360tray.exe
File opened (read-only)	\??\i:	360tray.exe
File opened (read-only)	\??\j:	360tray.exe
File opened (read-only)	\??\r:	360tray.exe
File opened (read-only)	\??\F:	360tray.exe
File opened (read-only)	\??\H:	360tray.exe
File opened (read-only)	\??\L:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\L:	360tray.exe
File opened (read-only)	\??\O:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\S:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\g:	360tray.exe
File opened (read-only)	\??\m:	360tray.exe
File opened (read-only)	\??\s:	360tray.exe
File opened (read-only)	\??\P:	360tray.exe
File opened (read-only)	\??\E:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\V:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\h:	360tray.exe
File opened (read-only)	\??\q:	360tray.exe
File opened (read-only)	\??\y:	360tray.exe
File opened (read-only)	\??\z:	360tray.exe
File opened (read-only)	\??\E:	360tray.exe
File opened (read-only)	\??\V:	360tray.exe
File opened (read-only)	\??\G:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\o:	360tray.exe
File opened (read-only)	\??\R:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\k:	360tray.exe
File opened (read-only)	\??\t:	360tray.exe
File opened (read-only)	\??\x:	360tray.exe
File opened (read-only)	\??\Q:	360tray.exe
File opened (read-only)	\??\R:	360tray.exe
File opened (read-only)	\??\P:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\I:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\N:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\U:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\M:	360tray.exe
File opened (read-only)	\??\F:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\Z:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\G:	360tray.exe
File opened (read-only)	\??\H:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\Y:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\n:	360tray.exe
File opened (read-only)	\??\I:	360tray.exe
File opened (read-only)	\??\Q:	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened (read-only)	\??\D:	360tray.exe
File opened (read-only)	\??\O:	360tray.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

Processes:

360safe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}	360safe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\NoExplorer = "1"	360safe.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description ioc process

File opened for modification \??\PhysicalDrive0 36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description ioc process

File opened for modification C:\autorun.inf 36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Drops file in System32 directory 1 IoCs

Processes:

360safe.exe

description ioc process

File created C:\Windows\SysWOW64\360SoftMgr.cpl 360safe.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
File opened for modification	C:\autorun.inf	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
File created	C:\Windows\SysWOW64\360SoftMgr.cpl	360safe.exe

Drops file in Program Files directory 38 IoCs

Processes:

360safe.exe360tray.exe36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exeSoftupNotify.exezhudongfangyu.exe

description	ioc	process
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\Register.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\safemon\param.ini	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\safemon\7z.dll	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\netmon\360netmon.ini	360tray.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File created	C:\Program Files (x86)\360\360Safe\{56F2EBE9-375D-4ac3-9D01-351B368B58F0}.tf	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\updatecfg.ini	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\filelist.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\AntiArp\dpath.ini	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\MiniUI.dll	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\SoftMgr\Config.ini	SoftupNotify.exe
File created	C:\Program Files (x86)\360\360Safe\SoftMgr\强力卸载电脑上的软件.lnk	SoftupNotify.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\360safe.setup	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\safemon\pairs.ini	360tray.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File created	C:\Program Files (x86)\360\360Safe\{A576EAC3-2C44-412f-9AD7-2DC6646026CC}.tf	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\360safe.setup	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg-journal	zhudongfangyu.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\Plugin.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\Plugin.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	zhudongfangyu.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\Register.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\UninstallRootDirFileList.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\SoftMgr\LiveInst.ini	SoftupNotify.exe
File created	C:\Program Files (x86)\360\360Safe\safemon\pairs.ini	360tray.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\updatecfg.ini	360tray.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
File created	C:\Program Files (x86)\360\360Safe\{771D966D-12A9-410d-B220-A7AD63FD2950}.tf	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\UninstallRootDirFileList.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\filelist.xml	360safe.exe

Drops file in Windows directory 1 IoCs

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI 36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3976 4316 WerFault.exe 36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

pid	pid_target	process	target process
3976	4316	WerFault.exe	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

SoftupNotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\don't load	SoftupNotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\don't load\360SoftMgr.cpl = "NO"	SoftupNotify.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

SoftupNotify.exe360tray.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\SoftManager.exe = "1"	SoftupNotify.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\SearchScopes	360tray.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	SoftupNotify.exe

Modifies registry class 64 IoCs

Processes:

360safe.exeSoftupNotify.exeregsvr32.exeregsvr32.exe360tray.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7418AFE6-6A10-479B-99FA-4AE0D39026A9}\1.0\0\win32\ = "C:\\Program Files (x86)\\360\\360Safe\\SoftMgr\\360SpeedTime.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E431A037-AE60-4D57-99D7-B402223AE8A0}\Shell\Open\command	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{467B32FF-C688-40FF-95FC-C7C61247B0AA}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\SoftMgr\\SMWebProxy.dll"	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{066F24B7-D820-4176-8B55-058A8F1BA583}\TypeLib	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{826D8B56-A99E-4CD2-8F38-CFCE2A7B89C4}\DefaultIcon\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,1"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6BC477E-2646-459A-9D6A-75902C24430D}\ShellEx\ContextMenuHandlers	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\ShellEx\	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\DefaultIcon\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,1"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\Shell\ = "Open"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{338CE0CA-987B-4CC9-8297-5430E7DCFD2A}\1.0\0\win32\ = "C:\\Program Files (x86)\\360\\360Safe\\Utils\\shell360ext.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\Shell\Open\ = "打开U盘 (&O)"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE3F69E2-3085-4C46-B050-A45F008827D6}\Shell\Open\command	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\ = "我的U盘 (I:)"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZHUSHOU360\Shell\Open\Command	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0B3184D-90C8-4F4D-B19A-42B6C659378B}\ShellEx\ContextMenuHandlers\	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\ShellEx\	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{749B9DBD-EBDC-4324-A3C3-95BF9E8234B1}\1.0\0\win32\ = "C:\\Program Files (x86)\\360\\360Safe\\SoftMgr\\SMWebProxy.dll"	SoftupNotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA1B1706-967F-4834-8405-2343A38E4086}\ShellEx\ContextMenuHandlers\	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\Shell\ = "Open"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SoftMgrExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEE8C32E-C785-4B1F-A33B-FCD6942418BD}\Shell\ = "Open"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\ShellEx\ContextMenuHandlers	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\Shell\Open\command\ = "%SystemRoot%\\explorer.exe P:\\"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\ = "我的U盘 (Z:)"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AD6078-180A-4924-BB11-9C3DA8A42C05}\ProgID\ = "SpeedTimeImpl.SpeedTimeImpl.1"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\Shell\Open	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{26CD0715-0722-479B-A8C7-29A911171774}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon.1	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\ = "我的U盘 (S:)"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{467B32FF-C688-40FF-95FC-C7C61247B0AA}\ProgID	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\softmanager360	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{467B32FF-C688-40FF-95FC-C7C61247B0AA}\Programmable	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{338CE0CA-987B-4CC9-8297-5430E7DCFD2A}\1.0\FLAGS	360safe.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA1B1706-967F-4834-8405-2343A38E4086}\ShellEx\	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{467B32FF-C688-40FF-95FC-C7C61247B0AA}\ProgID\ = "SMWebProxy.SoftMgrWebProxy.1"	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E715FE74-087F-4F4C-BB0A-0245C8A897E2}\ShellEx\ContextMenuHandlers	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEE8C32E-C785-4B1F-A33B-FCD6942418BD}\ShellEx	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E715FE74-087F-4F4C-BB0A-0245C8A897E2}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A06468-8A7C-4EFA-A61C-9C0E911194C9}\ShellFolder\Attributes = "536870912"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\ShellEx	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\DefaultIcon	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{338CE0CA-987B-4CC9-8297-5430E7DCFD2A}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\360SafeLive.Update.2\ = "360SafeLive"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\Shell\Open\command\ = "%SystemRoot%\\explorer.exe X:\\"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AD6078-180A-4924-BB11-9C3DA8A42C05}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\SoftMgr\\360SpeedTime.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon\CLSID\ = "{B69F34DD-F0F9-42DC-9EDD-957187DA688D}"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{056A6FBD-8148-443A-AAB2-DB3C46B1F083}\Shell\Open\command\ = "%SystemRoot%\\explorer.exe M:\\"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A06468-8A7C-4EFA-A61C-9C0E911194C9}\Shell\Open\command	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E431A037-AE60-4D57-99D7-B402223AE8A0}\Shell\Open\command\ = "%SystemRoot%\\explorer.exe Y:\\"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{451A36CF-D7AA-477D-AAD8-6AB2E2F043A1}\ = "shell360ext"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6BC477E-2646-459A-9D6A-75902C24430D}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87515F61-A66C-4319-A0E0-D416CB8059E3}\VersionIndependentProgID	360tray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{467B32FF-C688-40FF-95FC-C7C61247B0AA}\VersionIndependentProgID	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\DefaultIcon	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\Shell\Open\ = "打开U盘 (&O)"	360safe.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe360tray.exe360tray.exe

pid	process
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
2564	360tray.exe
2564	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe

Suspicious behavior: LoadsDriver 16 IoCs

Processes:

pid process

656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	pid	process
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
Token: SeDebugPrivilege	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

360tray.exeSoftMgrProxy64.exe36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

pid	process
3348	360tray.exe
4784	SoftMgrProxy64.exe
4784	SoftMgrProxy64.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
3348	360tray.exe
3348	360tray.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

360tray.exeSoftMgrProxy64.exe36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

pid	process
3348	360tray.exe
4784	SoftMgrProxy64.exe
4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
3348	360tray.exe
3348	360tray.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

360safe.exezhudongfangyu.exewsccontrol.exe360tray.exe360tray.exe360entcall.exeSoftupNotify.exeSoftMgrProxy64.exe

pid	process
3720	360safe.exe
4536	zhudongfangyu.exe
2780	wsccontrol.exe
2564	360tray.exe
2564	360tray.exe
3348	360tray.exe
3348	360tray.exe
3348	360tray.exe
5084	360entcall.exe
1460	SoftupNotify.exe
3348	360tray.exe
4784	SoftMgrProxy64.exe
4784	SoftMgrProxy64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	pid	process	target process
PID 4316 wrote to memory of 772	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 776	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 328	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	dwm.exe
PID 4316 wrote to memory of 2724	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	sihost.exe
PID 4316 wrote to memory of 2824	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 2888	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	taskhostw.exe
PID 4316 wrote to memory of 652	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	Explorer.EXE
PID 4316 wrote to memory of 3088	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 3296	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	DllHost.exe
PID 4316 wrote to memory of 3384	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	StartMenuExperienceHost.exe
PID 4316 wrote to memory of 3444	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 3544	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	SearchApp.exe
PID 4316 wrote to memory of 3680	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4612	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 1932	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	backgroundTaskHost.exe
PID 4316 wrote to memory of 4092	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 772	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 776	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 328	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	dwm.exe
PID 4316 wrote to memory of 2724	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	sihost.exe
PID 4316 wrote to memory of 2824	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 2888	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	taskhostw.exe
PID 4316 wrote to memory of 652	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	Explorer.EXE
PID 4316 wrote to memory of 3088	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 3296	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	DllHost.exe
PID 4316 wrote to memory of 3384	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	StartMenuExperienceHost.exe
PID 4316 wrote to memory of 3444	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 3544	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	SearchApp.exe
PID 4316 wrote to memory of 3680	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4612	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4092	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 772	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 776	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 328	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	dwm.exe
PID 4316 wrote to memory of 2724	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	sihost.exe
PID 4316 wrote to memory of 2824	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 2888	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	taskhostw.exe
PID 4316 wrote to memory of 652	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	Explorer.EXE
PID 4316 wrote to memory of 3088	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 3296	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	DllHost.exe
PID 4316 wrote to memory of 3384	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	StartMenuExperienceHost.exe
PID 4316 wrote to memory of 3444	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 3544	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	SearchApp.exe
PID 4316 wrote to memory of 3680	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4612	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4092	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 3720	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	360safe.exe
PID 4316 wrote to memory of 3720	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	360safe.exe
PID 4316 wrote to memory of 3720	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	360safe.exe
PID 4316 wrote to memory of 772	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 776	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	fontdrvhost.exe
PID 4316 wrote to memory of 328	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	dwm.exe
PID 4316 wrote to memory of 2724	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	sihost.exe
PID 4316 wrote to memory of 2824	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 2888	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	taskhostw.exe
PID 4316 wrote to memory of 652	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	Explorer.EXE
PID 4316 wrote to memory of 3088	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	svchost.exe
PID 4316 wrote to memory of 3296	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	DllHost.exe
PID 4316 wrote to memory of 3384	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	StartMenuExperienceHost.exe
PID 4316 wrote to memory of 3444	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 3544	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	SearchApp.exe
PID 4316 wrote to memory of 3680	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4612	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe
PID 4316 wrote to memory of 4092	4316	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe	RuntimeBroker.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:328

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3384

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3296

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:652

C:\Users\Admin\AppData\Local\Temp\36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe
"C:\Users\Admin\AppData\Local\Temp\36ef019e36c07eb2c3bb4c45dabecc750569dcb17d1f7f5867133018ba319c51.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4316

C:\Users\Admin\AppData\Local\Temp\360safe.exe
"C:\Users\Admin\AppData\Local\Temp\360safe.exe" /S /D=C:\Program Files (x86)\360\360Safe
3⤵
- Modifies system executable filetype association
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets service image path in registry
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3720

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Safe\Utils\shell360ext64.dll"
4⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1852

C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe
"C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe" /InstallAndStart
4⤵
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4536

C:\Program Files (x86)\360\360Safe\safemon\wsccontrol.exe
"C:\Program Files (x86)\360\360Safe\safemon\wsccontrol.exe" /regas:0_1
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780

C:\Program Files (x86)\360\360Safe\safemon\360tray.exe
"C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /TrayInstall /showtrayicon
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Program Files (x86)\360\360Safe\safemon\360tray.exe
"C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /elevated /TrayInstall /showtrayicon
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3348

C:\Program Files (x86)\360\360Safe\SoftMgr\SoftMgrProxy64.exe
"C:\Program Files (x86)\360\360Safe\SoftMgr\SoftMgrProxy64.exe" /64BITTASKBAR=hook
6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4784

C:\Program Files (x86)\360\360Safe\360entcall.exe
"C:\Program Files (x86)\360\360Safe\360entcall.exe" /setupent
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5084

C:\Program Files (x86)\360\360Safe\SoftMgr\SoftupNotify.exe
"C:\Program Files (x86)\360\360Safe\SoftMgr\SoftupNotify.exe" /install
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Safe\SoftMgr\SoftMgrExt64.dll"
5⤵
PID:1060

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\360\360Safe\SoftMgr\SoftMgrExt64.dll"
6⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 612
3⤵
- Program crash
PID:3976

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2724

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4092

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4852

C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe
"C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4316 -ip 4316
1⤵
PID:4512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Change Default File Association

T1042

Registry Run Keys / Startup Folder

Browser Extensions

T1176

Bootkit

T1067

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Bypass User Account Control

T1088

Disabling Security Tools

Credential Access

Discovery

Query Registry

T1012

System Information Discovery