e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d

Analysis

max time kernel
189s
max time network
208s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
Size

180KB
MD5

e90d46f9ff82f8d2ca880bf5d205a9dc
SHA1

2e902e05901d8670e1143f95e2cce1b0d37d5aab
SHA256

e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d
SHA512

b018e04d13a934bacc0c60c18df5f371381cd2b3ec4d72168e449d68ff68e32594ec960319ac4754d0b542987f955529575528f3aa2e2c4cf43f5408cde62de7
SSDEEP

3072:iQIURTXJ545Rm9Ta10eKTXLVojYKQa6VuryijIGdRz68qmUrp3EpuXREVq0T1f:is3FG12TRosKD6Syi8Gb81EQh8f

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

9377chiyue_Y_mgaz.exe

pid process

892 9377chiyue_Y_mgaz.exe

pid	process
892	9377chiyue_Y_mgaz.exe

Loads dropped DLL 27 IoCs

Processes:

e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe9377chiyue_Y_mgaz.exe

pid	process
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
892	9377chiyue_Y_mgaz.exe
892	9377chiyue_Y_mgaz.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9377chiyue_Y_mgaz.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	9377chiyue_Y_mgaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\CYCSAnimator = "\"C:\\Program Files (x86)\\9377-³àÔÂ´«Ëµ\\CycsAnimator.exe\" \"C:\\Program Files (x86)\\9377-³àÔÂ´«Ëµ\\ChiYue.dll\" 1"	9377chiyue_Y_mgaz.exe

Drops file in Program Files directory 4 IoCs

Processes:

e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exeLoginCycs.exe

description	ioc	process
File created	C:\Program Files (x86)\DriverSoft\Unload.exe	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs_V5.0.7z	LoginCycs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 1696 WerFault.exe LoginCycs.exe

pid	pid_target	process	target process
928	1696	WerFault.exe	LoginCycs.exe

NSIS installer 10 IoCs

installer

Processes:

resource	yara_rule
\Program Files (x86)\DriverSoft\Unload.exe	nsis_installer_1
\Program Files (x86)\DriverSoft\Unload.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeLoginCycs.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a10000000002000000000010660000000100002000000075af393fb342b88e01aa8d7f58139b5b7809c25f06cf1b4bd82de374d396edb9000000000e8000000002000020000000540694209e9a032f8977d2aa5876775e9ea8e59eb984b7488bea6458fd4f8ed4200000004228aecff3e7f00dae56d79465a0fc00ea2e90dfdff15349260b883d4275250f40000000159cc44f9677f372c932e57ff88e068af5585574e469a4f1875b24c888d584cf8d93b3ed9b91e639488bd9df423084710f82dbfa1f9f65fcfc889d1e781bb657	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375971840"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a8801338ffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a10000000002000000000010660000000100002000000036c4601edc054be12d8d5af9bb8a2725aeaefd4865609bf7baf36d3e0c11fc3f000000000e8000000002000020000000cac57061520c6c518a4bb0e32c3a642bb09d7c2ecf4cc085c68eca823aa73ce790000000ff8b6e7adc40b1f40ccf8e22ca24b5304f3e8bff2105c1e5da6a8ddc83df330326d20976d2b62ca715323c6ac79311495ef54374c0fe2c19dde5decba2617a901e420f49ce5782ee04e62f4e9b46c56cccda541395563e62a57398280836c6d5690230dd0a68ad2174fee292f1928e585a3a37b3d703c67e109e7f4fd23e299fb1a9cf1a2da0ca17a16b0ced0937042b400000004348566bcf6254e4edb44b78c5f27e52ab6a0a6bafa0ffc75326aedce3b99a1b800dbd43ffbd050b1f95737ecafd39879ac9642c6be1402cbbf86520814266b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2768AA91-6B2B-11ED-B3C3-5263E908E3CD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe

pid	process
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	896	AUDIODG.EXE
Token: 33	896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	896	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1708 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXELoginCycs.exe

pid process

1708 iexplore.exe
1708 iexplore.exe
1736 IEXPLORE.EXE
1736 IEXPLORE.EXE
1736 IEXPLORE.EXE
1736 IEXPLORE.EXE
1696 LoginCycs.exe
1696 LoginCycs.exe

pid	process
1708	iexplore.exe

pid	process
1708	iexplore.exe
1708	iexplore.exe
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1696	LoginCycs.exe
1696	LoginCycs.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exeiexplore.exeCycsAnimator.exeLoginCycs.execmd.exe

description	pid	process	target process
PID 1208 wrote to memory of 1708	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	iexplore.exe
PID 1208 wrote to memory of 1708	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	iexplore.exe
PID 1208 wrote to memory of 1708	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	iexplore.exe
PID 1208 wrote to memory of 1708	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	iexplore.exe
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1708 wrote to memory of 1736	1708	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1208 wrote to memory of 892	1208	e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe	9377chiyue_Y_mgaz.exe
PID 1268 wrote to memory of 1280	1268	CycsAnimator.exe	Explorer.EXE
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1696 wrote to memory of 1576	1696	LoginCycs.exe	cmd.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1576 wrote to memory of 1756	1576	cmd.exe	netsh.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe
PID 1696 wrote to memory of 928	1696	LoginCycs.exe	WerFault.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe
"C:\Users\Admin\AppData\Local\Temp\e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe"
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://k.shuianshanba.com/e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d.exe/sohu.jpg
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe
9377chiyue_Y_mgaz.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:892

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CycsAnimator.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CycsAnimator.exe" "C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ChiYue.dll" 1
4⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
4⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
5⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
6⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1692
5⤵
- Program crash
PID:928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x570
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe

Filesize
674KB

MD5
e258e77914272054d942bc9cb27ca477

SHA1
786c0c24b88898fb008da18b2ea7488b6a619fe4

SHA256
b34280131cf2daf8c71dfaf202a84904234faefdee19b4ab8d73ce2052cead4a

SHA512
1f9e50b18ec42fb78853729b19d88a17bb26fafcec735a8400e9d1acf20e49b9532e3fb0ecdddd0cc1e385907ac2d76d144971f513ac526a4e113ce31c98f50f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XNAEG91E.txt

Filesize
601B

MD5
aeabfc9c4ac20efce6fb50d2e07664de

SHA1
ab1e8524bdc455bc53b4843876d62557ddd04174

SHA256
4e4e4054fc3abae7fd242019502f7b112dab3e181790a39a5259db3bc771a091

SHA512
ba464820a630f32a1e39570a54687ec00e39fa8c577bed53f7ede89f0a8be56d815dc517812ebfca8e5aac3388a81a35c20586a6050ae0d652ec4d8276d0ab33

Download Submit
\Program Files (x86)\DriverSoft\Unload.exe

Filesize
180KB

MD5
e90d46f9ff82f8d2ca880bf5d205a9dc

SHA1
2e902e05901d8670e1143f95e2cce1b0d37d5aab

SHA256
e88fbef8466a495e44e4e449e991f7fca28abd05f11bd7c1595068015a85417d

SHA512
b018e04d13a934bacc0c60c18df5f371381cd2b3ec4d72168e449d68ff68e32594ec960319ac4754d0b542987f955529575528f3aa2e2c4cf43f5408cde62de7

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe

Filesize
674KB

MD5
e258e77914272054d942bc9cb27ca477

SHA1
786c0c24b88898fb008da18b2ea7488b6a619fe4

SHA256
b34280131cf2daf8c71dfaf202a84904234faefdee19b4ab8d73ce2052cead4a

SHA512
1f9e50b18ec42fb78853729b19d88a17bb26fafcec735a8400e9d1acf20e49b9532e3fb0ecdddd0cc1e385907ac2d76d144971f513ac526a4e113ce31c98f50f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe

Filesize
674KB

MD5
e258e77914272054d942bc9cb27ca477

SHA1
786c0c24b88898fb008da18b2ea7488b6a619fe4

SHA256
b34280131cf2daf8c71dfaf202a84904234faefdee19b4ab8d73ce2052cead4a

SHA512
1f9e50b18ec42fb78853729b19d88a17bb26fafcec735a8400e9d1acf20e49b9532e3fb0ecdddd0cc1e385907ac2d76d144971f513ac526a4e113ce31c98f50f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\9377chiyue_Y_mgaz.exe

Filesize
674KB

MD5
e258e77914272054d942bc9cb27ca477

SHA1
786c0c24b88898fb008da18b2ea7488b6a619fe4

SHA256
b34280131cf2daf8c71dfaf202a84904234faefdee19b4ab8d73ce2052cead4a

SHA512
1f9e50b18ec42fb78853729b19d88a17bb26fafcec735a8400e9d1acf20e49b9532e3fb0ecdddd0cc1e385907ac2d76d144971f513ac526a4e113ce31c98f50f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\NsProcess.dll

Filesize
4KB

MD5
05450face243b3a7472407b999b03a72

SHA1
ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

SHA256
95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

SHA512
f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE949.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/892-66-0x0000000000000000-mapping.dmp

Download
memory/928-80-0x0000000000000000-mapping.dmp

Download
memory/1208-54-0x0000000075C21000-0x0000000075C23000-memory.dmp

Filesize
8KB

Download
memory/1576-75-0x0000000000000000-mapping.dmp

Download
memory/1756-77-0x0000000000000000-mapping.dmp

Download