6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
Size

52KB
MD5

38fad30c6ee239246741b4991d8d1720
SHA1

b2da0d90a56e3ce0508d34b882c6937e230e3edc
SHA256

6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c
SHA512

5401f6acb1a41a97cd0561fba8916650df2ad4ec9491323870a6642bf41717ed7365ea0313b1b93273a1eaf6e13bb0402b525f723f761abf2a5db66d20d7f710
SSDEEP

768:EclW/lMFggAKwU0DN1C0wlfAenhODYaG426VmkblAYG3iqKMP65PuMPI2hTTToT:tWN/gAKqfCmQhOp2Yb9wbPCP5QqTToT

Score

8^/10

adware persistence stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3452	smss.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4904-134-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/4904-150-0x0000000000400000-0x0000000000439000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
3748	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\baidu = "c:\\windows\\qgln\\smss.exe "	reg.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\ = "??????"	regedit.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\axpct\ktaij.dll	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File created	C:\Program Files\Maxthon2\SharedAccount\Config\MxSpeedDial\SpeedDial.ini	WScript.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\userid.txt	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File opened for modification	C:\Windows\qgln\smss.exe	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File created	C:\Windows\WindowsMy.reg	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File created	C:\Windows\ShowIeLinkIe6.reg	WScript.exe
File created	C:\Windows\ShowIeLinkIe7.reg	WScript.exe
File created	C:\Windows\sprgp.vbe	WScript.exe
File opened for modification	C:\Windows\jg\indexOlds.vbe	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File created	C:\Windows\reg.reg	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File created	C:\Windows\del.tmp.bho.bho.bho.vbs	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
File created	C:\Windows\SetWindowsIndex.reg	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000340000001b000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 65cf80b551e1c349b73f70b13fca8e86	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\LinksFolderName = "Á´½Ó"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c00000000000004681000000100000009ed10ec233ecca01e61abf65c5edca019ed10ec233ecca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c00310000000000a53c284a1000444f43554d457e310000440003000400efbea53c1249a73cf1481400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a63c8e0c100041444d494e497e310000320003000400efbea53c284aa73cf14814000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a63c760f11004641564f52497e3100003e0003000400efbea53c284aa73c3344140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a53c294a1000fe94a56300001c0003000400efbea53c294aa73c334414000000fe94a56300001400000060000000030000a0580000000000000068792d3636796c7032363264663675000ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e00026180888870ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e000261808888700000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c0000000000000468100000010000000feb8496527bbc90112c0b16e27bbc9015aac066827bbc9010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008c3acb231000444f43554d457e310000440003000400efbe8c3ada218c3acb231400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a003100000000008c3acc23100041444d494e497e310000320003000400efbe8c3acb238c3acc2314000000410064006d0069006e006900730074007200610074006f0072000000180056003100000000008c3ace2311004641564f52497e3100003e0003000400efbe8c3acb238c3ace23140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d313236393300180030003500000000008c3acf231000fe94a56300001c0003000400efbe8c3acc238c3acf2314000000fe94a56300001400000060000000030000a0580000000000000067686f73747870332d3436373638300008fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa208fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa200000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000030000000140000002a000000010000008006000080010000030000008102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{F2CF5485-4E02-4F68-819C-B92DE9277049} = 8554cff2024e684f819cb92de927704922001c000800000006000000010000000000000000000000000000004c0000000114020000000000c000000000000046810000001000000010a155c0ffe9ca0118bf0ffd11edca0118bf0ffd11edca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008e3ab9151000444f43554d457e310000440003000400efbe8c3ada21a23c2c701400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a53c0586100041444d494e497e310000320003000400efbe8c3acb23a53c058614000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a23c809611004641564f52497e3100003e0003000400efbea23c0070a23c8096140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a63ce45d1000fe94a56300001c0003000400efbea23c0070a63ce45d14000000fe94a56300001400000060000000030000a058000000000000007063323031303035303232317663620008fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824608fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824600000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Explorer\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006200000001000000a0060000a00f000005000000220400002600000002000000a10600006001000004000000a1000000c600000003000000a1020000d4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000030000002003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.dianxin.cn?158"	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\ProgID\ = "QvodAdBlocker.QvodBlocks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ = "Internet Explorer"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\TypeLib\ = "{03C2388B-1A78-4346-90CB-2292392F8D6C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\ = "QvodAdBlocker.QvodBlocks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlocks	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\??(&R)	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ = "_QvodBlocks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\TypeLib\ = "{03C2388B-1A78-4346-90CB-2292392F8D6C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\??(&R)\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ = "QvodBlocks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\ = "????(&H)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command\ = "Rundll32.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\InprocServer32\ = "C:\\Program Files\\axpct\\ktaij.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\0\win32\ = "C:\\Program Files\\axpct\\ktaij.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\TypeLib\ = "{03C2388B-1A78-4346-90CB-2292392F8D6C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\Attributes = 00000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\ = "QvodAdBlocker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ = "_QvodBlocks"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlocks\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shdocvw.dll"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlocks\ = "QvodAdBlocker.QvodBlocks"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DB494AC-17AA-4CC1-84CC-DA54AED8A423}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\ = "00.00.00.00"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03C2388B-1A78-4346-90CB-2292392F8D6C}\1.0\HELPDIR\ = "C:\\Program Files\\axpct"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97AF410F-3CF9-4A18-9FBD-F727045B3086}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.dianxin.cn?158"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\ = "??(&D)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\??(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder	regedit.exe

Runs .reg file with regedit 5 IoCs

pid	Process
4988	regedit.exe
4024	regedit.exe
4412	regedit.exe
4048	regedit.exe
3584	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
3452	smss.exe
3452	smss.exe
3452	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1192	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	87
PID 4904 wrote to memory of 1192	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	87
PID 4904 wrote to memory of 1192	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	87
PID 4904 wrote to memory of 3452	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	88
PID 4904 wrote to memory of 3452	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	88
PID 4904 wrote to memory of 3452	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	88
PID 4904 wrote to memory of 3748	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	89
PID 4904 wrote to memory of 3748	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	89
PID 4904 wrote to memory of 3748	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	89
PID 4904 wrote to memory of 3524	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	90
PID 4904 wrote to memory of 3524	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	90
PID 4904 wrote to memory of 3524	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	90
PID 4904 wrote to memory of 4592	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	91
PID 4904 wrote to memory of 4592	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	91
PID 4904 wrote to memory of 4592	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	91
PID 4904 wrote to memory of 3676	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	94
PID 4904 wrote to memory of 3676	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	94
PID 4904 wrote to memory of 3676	4904	6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe	94
PID 3524 wrote to memory of 4988	3524	cmd.exe	95
PID 3524 wrote to memory of 4988	3524	cmd.exe	95
PID 3524 wrote to memory of 4988	3524	cmd.exe	95
PID 4592 wrote to memory of 4024	4592	cmd.exe	96
PID 4592 wrote to memory of 4024	4592	cmd.exe	96
PID 4592 wrote to memory of 4024	4592	cmd.exe	96
PID 1192 wrote to memory of 4412	1192	WScript.exe	98
PID 1192 wrote to memory of 4412	1192	WScript.exe	98
PID 1192 wrote to memory of 4412	1192	WScript.exe	98
PID 1192 wrote to memory of 4048	1192	WScript.exe	99
PID 1192 wrote to memory of 4048	1192	WScript.exe	99
PID 1192 wrote to memory of 4048	1192	WScript.exe	99
PID 1192 wrote to memory of 3584	1192	WScript.exe	100
PID 1192 wrote to memory of 3584	1192	WScript.exe	100
PID 1192 wrote to memory of 3584	1192	WScript.exe	100
PID 1192 wrote to memory of 1276	1192	WScript.exe	102
PID 1192 wrote to memory of 1276	1192	WScript.exe	102
PID 1192 wrote to memory of 1276	1192	WScript.exe	102
PID 1192 wrote to memory of 2116	1192	WScript.exe	104
PID 1192 wrote to memory of 2116	1192	WScript.exe	104
PID 1192 wrote to memory of 2116	1192	WScript.exe	104
PID 1192 wrote to memory of 3176	1192	WScript.exe	106
PID 1192 wrote to memory of 3176	1192	WScript.exe	106
PID 1192 wrote to memory of 3176	1192	WScript.exe	106
PID 1192 wrote to memory of 1676	1192	WScript.exe	110
PID 1192 wrote to memory of 1676	1192	WScript.exe	110
PID 1192 wrote to memory of 1676	1192	WScript.exe	110
PID 1192 wrote to memory of 5040	1192	WScript.exe	109
PID 1192 wrote to memory of 5040	1192	WScript.exe	109
PID 1192 wrote to memory of 5040	1192	WScript.exe	109
PID 1192 wrote to memory of 2432	1192	WScript.exe	112
PID 1192 wrote to memory of 2432	1192	WScript.exe	112
PID 1192 wrote to memory of 2432	1192	WScript.exe	112
PID 1192 wrote to memory of 4564	1192	WScript.exe	114
PID 1192 wrote to memory of 4564	1192	WScript.exe	114
PID 1192 wrote to memory of 4564	1192	WScript.exe	114
PID 1192 wrote to memory of 4744	1192	WScript.exe	116
PID 1192 wrote to memory of 4744	1192	WScript.exe	116
PID 1192 wrote to memory of 4744	1192	WScript.exe	116
PID 1192 wrote to memory of 5104	1192	WScript.exe	118
PID 1192 wrote to memory of 5104	1192	WScript.exe	118
PID 1192 wrote to memory of 5104	1192	WScript.exe	118
PID 1192 wrote to memory of 5060	1192	WScript.exe	120
PID 1192 wrote to memory of 5060	1192	WScript.exe	120
PID 1192 wrote to memory of 5060	1192	WScript.exe	120
PID 1192 wrote to memory of 4064	1192	WScript.exe	122

C:\Users\Admin\AppData\Local\Temp\6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe
"C:\Users\Admin\AppData\Local\Temp\6c222f6429e297f517eed9bc737a19e8eec08a3c840d70441c47836923b3761c.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\jg\indexOlds.vbe" 0
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
    3⤵
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Runs .reg file with regedit
    PID:4412
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\ShowIeLinkIe6.reg
    3⤵
    - Modifies Internet Explorer settings
    - Runs .reg file with regedit
    PID:4048
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\ShowIeLinkIe7.reg
    3⤵
    - Modifies Internet Explorer settings
    - Runs .reg file with regedit
    PID:3584
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internt Explorer.llnk" /e /c /r Administrators
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internt Explorer.llnk" /e /c /r Administrator
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internt Explorer.llnk" /e /c /r users
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internt Explorer.llnk" /e /c /r everyone
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internt Explorer.llnk" /e /c /r system
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internt Explorer.llnk" /e /c /r user
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internt Explorer.llnk" /e /c /r Administrators
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internt Explorer.llnk" /e /c /r Administrator
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internt Explorer.llnk" /e /c /r users
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internt Explorer.llnk" /e /c /r system
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internt Explorer.llnk" /e /c /r everyone
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internt Explorer.llnk" /e /c /r user
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internt Explorer.llnk" /e /c /r Administrators
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internt Explorer.llnk" /e /c /r Administrator
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internt Explorer.llnk" /e /c /r users
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internt Explorer.llnk" /e /c /r system
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internt Explorer.llnk" /e /c /r everyone
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internt Explorer.llnk" /e /c /r user
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌÔ±¦¹ºÎï.Tao" /e /c /r Administrators
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌÔ±¦¹ºÎï.Tao" /e /c /r Administrator
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌÔ±¦¹ºÎï.Tao" /e /c /r users
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌÔ±¦¹ºÎï.Tao" /e /c /r system
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌÔ±¦¹ºÎï.Tao" /e /c /r everyone
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌÔ±¦¹ºÎï.Tao" /e /c /r user
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Mozilla Firefox.fox" /e /c /r Administrators
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Mozilla Firefox.fox" /e /c /r Administrator
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Mozilla Firefox.fox" /e /c /r users
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Mozilla Firefox.fox" /e /c /r system
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Mozilla Firefox.fox" /e /c /r everyone
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Mozilla Firefox.fox" /e /c /r user
    3⤵
    PID:2052
- C:\Windows\qgln\smss.exe
  C:\Windows\qgln\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3452
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "baidu" /d "c:\windows\qgln\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2432
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files\axpct\ktaij.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:3748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regedit.exe /s C:\Windows\reg.reg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\regedit.exe
    regedit.exe /s C:\Windows\reg.reg
    3⤵
    - Installs/modifies Browser Helper Object
    - Runs .reg file with regedit
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regedit.exe /s C:\Windows\WindowsMy.reg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\regedit.exe
    regedit.exe /s C:\Windows\WindowsMy.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:4024
- C:\Windows\SysWOW64\WScript.Exe
  WScript.Exe C:\Windows\del.tmp.bho.bho.bho.vbs
  2⤵
  PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\axpct\ktaij.dll

Filesize
28KB

MD5
3828594d73900c5c5358e17e28ac21b1

SHA1
df78ecd976d828c53332184df37cd8876dbed1a2

SHA256
d038403782ece2e16cd79f8f4a33df35558ce23a885d126094a377b4c94d8925

SHA512
5858691cbf5e7ca95687bed6e75afa65d55ec18e193528a7b997febbba0a8038cde0036ec45447bc02bff4fce8988cea11ef9f9ef759c84e82f5d9af02db5499

Download Submit
C:\Program Files\axpct\ktaij.dll

Filesize
28KB

MD5
3828594d73900c5c5358e17e28ac21b1

SHA1
df78ecd976d828c53332184df37cd8876dbed1a2

SHA256
d038403782ece2e16cd79f8f4a33df35558ce23a885d126094a377b4c94d8925

SHA512
5858691cbf5e7ca95687bed6e75afa65d55ec18e193528a7b997febbba0a8038cde0036ec45447bc02bff4fce8988cea11ef9f9ef759c84e82f5d9af02db5499

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ie.vbe

Filesize
285B

MD5
ab0a0848ec0670b7d47a5c6b80e6c4d5

SHA1
6ee2a01efd891cbdbceaef65730cf64aa8f87e2f

SHA256
855d2a8ee25b33026cb20c1b878d9c17b832db1f33dc3ae05767082d46cdb39d

SHA512
3bc7b8ee02942988bc503626e4b1817dbcb0a8b9bb14860bf8f38785cf86b6e40430c7e493a79a79335bb949823521627f7c6446e2139f649226b386551594c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\index.vbe

Filesize
231KB

MD5
2e6cb75b2e684c2b9dbc8be03852c184

SHA1
5b7aecd81cbd01f18718a2e0babffce726df16ad

SHA256
46a17ffc7ea47093235473d7bac2460e34947ffbc695c5e5c6503ae31e145801

SHA512
d1ad051b093997ffe05db59d4e46a12f270619b43494a75709f4dfd32062a26f3938f76af3ace8fbeea85e61b8188ecafd600324127f4169035448133250a48e

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
143B

MD5
26132fb9275279ed2e0be0291b3fbaac

SHA1
a52d4e46a22319d2f0faffada1d68c184240d1df

SHA256
3b3e7d76d7245baaa7e6aaa8f1a760f67181cc5a3646e26f21489aa820ec6bc2

SHA512
e4001c9f3e9e0f7df99e4b0c089e84385344c08d2cb9f5147cb957b1533e6f0f0a7381b017e922b7b3edd122653e40ba2c0d409b71f1e7401469fc2b90b74f6e

Download Submit
C:\Windows\ShowIeLinkIe6.reg

Filesize
7KB

MD5
4f69fa82c34c91514da21a5933644af8

SHA1
e131f57f41ce95b46195d460852718b83517579a

SHA256
7cd8b741bfaee5cd14779b69d71b362aac4c928097c6b4af8ce0ce16bde52a46

SHA512
276588f960d28023febd87873c7852f401ab6ebfb3d90bf8b21b1998949d8ab00badb42d1a05934587aa6b4ad0ab06a3d649dcdb70f384ca70339049243463c4

Download Submit
C:\Windows\ShowIeLinkIe7.reg

Filesize
9KB

MD5
dbd46bf2e72f6dfbb21295f4e3066d47

SHA1
cdd6ca2f6455c1e528c40a520bcdb8669df8f548

SHA256
71927f4f034db038385346e34209ad069139f54d73bae34bfaf4f29b7010fc6b

SHA512
ad013387a0c7608375b7a3c5fdb27f0d9e79b051d84b1ee9221346499f386d30473b5e2727f6a4e8a8122cf8ac2d473a5ce5e368e62da09441ed48e5c088bd11

Download Submit
C:\Windows\WindowsMy.reg

Filesize
1KB

MD5
958217370aa43a176700027f14d8620d

SHA1
301edce9b46a9b6d67378b83ef4c98c280c32e3e

SHA256
d0f35efe4fda41b828ecfb10b17673d2b2a972476dea85204e45a4b9edda055f

SHA512
283048c76f0b2eabcc69764dde29c75228f65630feb65df27379153b454dbf240dee2f967cb722904b3b570ea5d5570096d5320745522b4ccff86e6cc2dad5a8

Download Submit
C:\Windows\del.tmp.bho.bho.bho.vbs

Filesize
474B

MD5
49083dbce7187c5336d66b27117c2d50

SHA1
4c80cbf0199569526058280b8de371077676e3fe

SHA256
54bc23c50fdd5f6096cd8199f8ced0caad7c4cf8b09a0e201f8961dcb75255a8

SHA512
d750fbb708a8f72000d553aba01d444ce002cda9fdbed426c54ee6ce4a37863a2992af23df073d704fa253709ac9279880faacb401564b0e059ab1ec5a3cddcc

Download Submit
C:\Windows\jg\indexOlds.vbe

Filesize
231KB

MD5
5c2024a03bc2db942b729cf4d631ee43

SHA1
cad97d69addfef893f4302dfa741e7aee60d0058

SHA256
26b870e320dff2606108635af51212ee4f61f442e6aea9998b74d1036efb7db1

SHA512
159d576653aaa442581295f7fc6a612f98b66ea2c487806363e35dd2c78425a8aac215b77fa5bbc2233e2c06622c4d576d2603ca4ad1866eff137916228af681

Download Submit
C:\Windows\qgln\smss.exe

Filesize
64KB

MD5
cbac52bb2b9e20b24ef7c47d7e9a4fa4

SHA1
17f20b8a479167e988a1a71ff05e9caf09a5ffc8

SHA256
390b9fd28632280fd79a5e3f19b86cfe6634d90ede18e9e7aeef9d748f4683fa

SHA512
d36305aa1ae3c04e9618ee4d82a89759d6f633cba17b29dc9b600464adc04e6cd8afa980bd663aed5291175001be82fb336bba68c344144f6d03bec75597f9b5

Download Submit
C:\Windows\qgln\smss.exe

Filesize
64KB

MD5
cbac52bb2b9e20b24ef7c47d7e9a4fa4

SHA1
17f20b8a479167e988a1a71ff05e9caf09a5ffc8

SHA256
390b9fd28632280fd79a5e3f19b86cfe6634d90ede18e9e7aeef9d748f4683fa

SHA512
d36305aa1ae3c04e9618ee4d82a89759d6f633cba17b29dc9b600464adc04e6cd8afa980bd663aed5291175001be82fb336bba68c344144f6d03bec75597f9b5

Download Submit
C:\Windows\reg.reg

Filesize
185B

MD5
e306a0be95a54a6455e7ed15466d5d81

SHA1
6cb2f94dee7cf4fefcf3b80f311e70fed747e2fd

SHA256
685f6bbe7c8e99402adaf80dcde15110320d49ddf9c4c5d457a6a5601381b7a2

SHA512
35c36e4f01803d4831939fbeae3566b9e58bf499bfe620a639b11da22b9892d7fa2db65f1cba6a7ffbc2f7aec296f9f74767e96c6585cadf5e347d0613dd23d5

Download Submit
memory/4904-150-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4904-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads