6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665

Analysis

max time kernel
188s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe
Size

148KB
MD5

33acba5bc6dc7200bbcbf5528a392b7b
SHA1

80838a9c87c5436eb95e9934d9dd6ad87784541d
SHA256

6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665
SHA512

f6dc9defe54cbcbc03c6d8fac5eaea2d1ffc2034c59868b7dbc2ea8fa8b18ab7bf3e161a6d110fac562f93a4009e960e7bdea9abec0b4147b7396f479ebd6642
SSDEEP

3072:4RQe3L7SPI8SxLDRuCX+iEuegzWn3gRA2ori:4RQu7ohSVA+EuLaONoe

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

VRr85ImhQE22RXj.exeDownFiles.exescript.exesmss.exe

pid process

3032 VRr85ImhQE22RXj.exe
3384 DownFiles.exe
364 script.exe
1440 smss.exe

pid	process
3032	VRr85ImhQE22RXj.exe
3384	DownFiles.exe
364	script.exe
1440	smss.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exeVRr85ImhQE22RXj.exescript.execmd.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	VRr85ImhQE22RXj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4164 regsvr32.exe

pid	process
4164	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\flashget = "c:\\windows\\20221124\\p8qo8c2mgc5vfqhv\\smss.exe "	reg.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regedit.exe

Drops file in System32 directory 2 IoCs

Processes:

xcopy.exe

description ioc process

File created C:\Windows\SysWOW64\XlKankan.dll xcopy.exe
File opened for modification C:\Windows\SysWOW64\XlKankan.dll xcopy.exe

description	ioc	process
File created	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe

Drops file in Program Files directory 2 IoCs

Processes:

DownFiles.exe

description	ioc	process
File created	C:\Program Files\Funshion Online\Funshion\Funshion.exe.bat	DownFiles.exe
File created	C:\Program Files\pipi\PIPIPlayer.exe.bat	DownFiles.exe

Drops file in Windows directory 27 IoCs

Processes:

script.exeWScript.exeVRr85ImhQE22RXj.exeDownFiles.exesmss.exexcopy.exe

description	ioc	process
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\Script.vbs.bat	script.exe
File created	C:\Windows\search.reg	WScript.exe
File created	C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe	VRr85ImhQE22RXj.exe
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\regBHO.reg	VRr85ImhQE22RXj.exe
File opened for modification	C:\Windows\SetWindowsIndex.reg	WScript.exe
File opened for modification	C:\Windows\userid.txt	DownFiles.exe
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.vbs	VRr85ImhQE22RXj.exe
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\reg.bat	VRr85ImhQE22RXj.exe
File created	C:\Windows\AddRight.reg	WScript.exe
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe	VRr85ImhQE22RXj.exe
File created	C:\Windows\MyShowIeLinkIe7.reg	WScript.exe
File created	C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe.bat	VRr85ImhQE22RXj.exe
File created	C:\Windows\iniqeh.vbs	WScript.exe
File created	C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe	VRr85ImhQE22RXj.exe
File created	C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe.bat	VRr85ImhQE22RXj.exe
File opened for modification	C:\Windows\share\data\rand_create\20221124\20221124.txt	DownFiles.exe
File created	C:\Windows\share\data\rand_create\20221124\20221124.txt	DownFiles.exe
File opened for modification	C:\Windows\userid.txt	script.exe
File created	C:\Windows\.reg	WScript.exe
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\XlKankan.dll	VRr85ImhQE22RXj.exe
File created	C:\Windows\tao.ico	VRr85ImhQE22RXj.exe
File created	C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe.bat	VRr85ImhQE22RXj.exe
File created	C:\Windows\MYShowIeLinkIe6.reg	WScript.exe
File created	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\Survival_0.txt	smss.exe
File created	C:\Windows\userid.txt	VRr85ImhQE22RXj.exe
File opened for modification	C:\Windows\SysWOW64	xcopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

xcopy.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

Processes:

regedit.exesmss.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/youdao.htm"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/baidu.htm"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}.ico"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\URL = "http://www.mylovewebs.com/api/taobao/so.htm?word={searchTerms}"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000340000001b000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\SortIndex = "2"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{E140FB5B-2A9D-4FA4-A20F-089B92412200}.ico"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\LinksFolderName = "Á´½Ó"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 65cf80b551e1c349b73f70b13fca8e86	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\SearchScopes	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\DisplayName = "°Ù¶ÈÒ»ÏÂ£¬Äã¾ÍÖªµÀ"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/google.htm"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c00000000000004681000000100000009ed10ec233ecca01e61abf65c5edca019ed10ec233ecca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c00310000000000a53c284a1000444f43554d457e310000440003000400efbea53c1249a73cf1481400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a63c8e0c100041444d494e497e310000320003000400efbea53c284aa73cf14814000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a63c760f11004641564f52497e3100003e0003000400efbea53c284aa73c3344140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a53c294a1000fe94a56300001c0003000400efbea53c294aa73c334414000000fe94a56300001400000060000000030000a0580000000000000068792d3636796c7032363264663675000ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e00026180888870ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e000261808888700000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c0000000000000468100000010000000feb8496527bbc90112c0b16e27bbc9015aac066827bbc9010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008c3acb231000444f43554d457e310000440003000400efbe8c3ada218c3acb231400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a003100000000008c3acc23100041444d494e497e310000320003000400efbe8c3acb238c3acc2314000000410064006d0069006e006900730074007200610074006f0072000000180056003100000000008c3ace2311004641564f52497e3100003e0003000400efbe8c3acb238c3ace23140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d313236393300180030003500000000008c3acf231000fe94a56300001c0003000400efbe8c3acc238c3acf2314000000fe94a56300001400000060000000030000a0580000000000000067686f73747870332d3436373638300008fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa208fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa200000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\DisplayName = "ÌÔ±¦ËÑË÷"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000030000002003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{F2CF5485-4E02-4F68-819C-B92DE9277049} = 8554cff2024e684f819cb92de927704922001c000800000006000000010000000000000000000000000000004c0000000114020000000000c000000000000046810000001000000010a155c0ffe9ca0118bf0ffd11edca0118bf0ffd11edca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008e3ab9151000444f43554d457e310000440003000400efbe8c3ada21a23c2c701400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a53c0586100041444d494e497e310000320003000400efbe8c3acb23a53c058614000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a23c809611004641564f52497e3100003e0003000400efbea23c0070a23c8096140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a63ce45d1000fe94a56300001c0003000400efbea23c0070a63ce45d14000000fe94a56300001400000060000000030000a058000000000000007063323031303035303232317663620008fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824608fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824600000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\URL = "http://www.mylovewebs.com/api/baidu/so.htm?word={searchTerms}"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconURL = "http://www.taobao.com/favicon.ico"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Explorer\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/index.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000030000000140000002a000000010000008006000080010000030000008102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\SortIndex = "6"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006200000001000000a0060000a00f000005000000220400002600000002000000a10600006001000004000000a1000000c600000003000000a1020000d4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

regedit.exeregedit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1456"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1456"	regedit.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregedit.exescript.execmd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shdocvw.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\ = "É¾³ý(&D)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\ = "00.00.00.00"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.txt = "txtfile"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "AllTypes"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\Attributes = 00000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "AllTypes"	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.zaodezhu.com/?my=1456"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\ = "´ò¿ªÖ÷Ò³(&H)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command\ = "\"C:\\Windows\\20221124\\sEaRI8lhum8yC5Y2\\script\\script.exe\" \"%1\""	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ = "Internet Explorer"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ProgID\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\ = "QvodAdBlocker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\Clsid\ = "{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR\ = "C:\\Windows\\System32"	regsvr32.exe

Runs .reg file with regedit 8 IoCs

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

pid process

1700 regedit.exe
2036 regedit.exe
2268 regedit.exe
960 regedit.exe
1092 regedit.exe
724 regedit.exe
3752 regedit.exe
4084 regedit.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

DownFiles.exesmss.exe

pid process

3384 DownFiles.exe
3384 DownFiles.exe
3384 DownFiles.exe
3384 DownFiles.exe
1440 smss.exe
1440 smss.exe
1440 smss.exe

pid	process
1700	regedit.exe
2036	regedit.exe
2268	regedit.exe
960	regedit.exe
1092	regedit.exe
724	regedit.exe
3752	regedit.exe
4084	regedit.exe

pid	process
3384	DownFiles.exe
3384	DownFiles.exe
3384	DownFiles.exe
3384	DownFiles.exe
1440	smss.exe
1440	smss.exe
1440	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.execmd.exeVRr85ImhQE22RXj.execmd.execmd.exescript.execmd.execmd.execmd.exeWScript.exe

description	pid	process	target process
PID 2440 wrote to memory of 5068	2440	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe	cmd.exe
PID 2440 wrote to memory of 5068	2440	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe	cmd.exe
PID 2440 wrote to memory of 5068	2440	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe	cmd.exe
PID 2440 wrote to memory of 1516	2440	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe	cmd.exe
PID 2440 wrote to memory of 1516	2440	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe	cmd.exe
PID 2440 wrote to memory of 1516	2440	6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe	cmd.exe
PID 5068 wrote to memory of 3032	5068	cmd.exe	VRr85ImhQE22RXj.exe
PID 5068 wrote to memory of 3032	5068	cmd.exe	VRr85ImhQE22RXj.exe
PID 5068 wrote to memory of 3032	5068	cmd.exe	VRr85ImhQE22RXj.exe
PID 3032 wrote to memory of 3608	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 3608	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 3608	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3608 wrote to memory of 3384	3608	cmd.exe	DownFiles.exe
PID 3608 wrote to memory of 3384	3608	cmd.exe	DownFiles.exe
PID 3608 wrote to memory of 3384	3608	cmd.exe	DownFiles.exe
PID 3032 wrote to memory of 884	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 884	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 884	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 884 wrote to memory of 364	884	cmd.exe	script.exe
PID 884 wrote to memory of 364	884	cmd.exe	script.exe
PID 884 wrote to memory of 364	884	cmd.exe	script.exe
PID 364 wrote to memory of 3512	364	script.exe	cmd.exe
PID 364 wrote to memory of 3512	364	script.exe	cmd.exe
PID 364 wrote to memory of 3512	364	script.exe	cmd.exe
PID 364 wrote to memory of 1612	364	script.exe	cmd.exe
PID 364 wrote to memory of 1612	364	script.exe	cmd.exe
PID 364 wrote to memory of 1612	364	script.exe	cmd.exe
PID 1612 wrote to memory of 2268	1612	cmd.exe	xcopy.exe
PID 1612 wrote to memory of 2268	1612	cmd.exe	xcopy.exe
PID 1612 wrote to memory of 2268	1612	cmd.exe	xcopy.exe
PID 3032 wrote to memory of 2580	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 2580	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 2580	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 4696	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 4696	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3032 wrote to memory of 4696	3032	VRr85ImhQE22RXj.exe	cmd.exe
PID 3512 wrote to memory of 1840	3512	cmd.exe	WScript.exe
PID 3512 wrote to memory of 1840	3512	cmd.exe	WScript.exe
PID 3512 wrote to memory of 1840	3512	cmd.exe	WScript.exe
PID 1612 wrote to memory of 4084	1612	cmd.exe	regedit.exe
PID 1612 wrote to memory of 4084	1612	cmd.exe	regedit.exe
PID 1612 wrote to memory of 4084	1612	cmd.exe	regedit.exe
PID 1612 wrote to memory of 4164	1612	cmd.exe	regsvr32.exe
PID 1612 wrote to memory of 4164	1612	cmd.exe	regsvr32.exe
PID 1612 wrote to memory of 4164	1612	cmd.exe	regsvr32.exe
PID 2580 wrote to memory of 1440	2580	cmd.exe	smss.exe
PID 2580 wrote to memory of 1440	2580	cmd.exe	smss.exe
PID 2580 wrote to memory of 1440	2580	cmd.exe	smss.exe
PID 1840 wrote to memory of 1152	1840	WScript.exe	attrib.exe
PID 1840 wrote to memory of 1152	1840	WScript.exe	attrib.exe
PID 1840 wrote to memory of 1152	1840	WScript.exe	attrib.exe
PID 1840 wrote to memory of 376	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 376	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 376	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 4076	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 4076	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 4076	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 2700	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 2700	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 2700	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 1304	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 1304	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 1304	1840	WScript.exe	cacls.exe
PID 1840 wrote to memory of 5084	1840	WScript.exe	cacls.exe

Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

1152 attrib.exe
3468 attrib.exe
3884 attrib.exe
2376 attrib.exe

pid	process
1152	attrib.exe
3468	attrib.exe
3884	attrib.exe
2376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe
"C:\Users\Admin\AppData\Local\Temp\6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe
"C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe
"C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe"
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe
"C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\Script.vbs.bat" "
6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3512

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.vbs"
7⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" +r +s
8⤵
- Views/modifies file attributes
PID:1152

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrators
8⤵
PID:376

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c Administrators:CI
8⤵
PID:4076

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrator
8⤵
PID:2700

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r users
8⤵
PID:1304

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r system
8⤵
PID:5084

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r everyone
8⤵
PID:3928

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r user
8⤵
PID:620

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Power Users"
8⤵
PID:3372

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Admin"
8⤵
PID:2168

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" +r +s
8⤵
- Views/modifies file attributes
PID:3468

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrators
8⤵
PID:4056

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c Administrators:CI
8⤵
PID:4816

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrator
8⤵
PID:1164

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r users
8⤵
PID:3124

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r system
8⤵
PID:1376

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r everyone
8⤵
PID:364

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r user
8⤵
PID:3772

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Power Users"
8⤵
PID:2196

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Admin"
8⤵
PID:1336

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" +r +s
8⤵
- Views/modifies file attributes
PID:3884

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrators
8⤵
PID:4240

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c Administrators:CI
8⤵
PID:1672

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrator
8⤵
PID:4436

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r users
8⤵
PID:2188

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r system
8⤵
PID:1852

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r everyone
8⤵
PID:1904

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r user
8⤵
PID:724

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Power Users"
8⤵
PID:2060

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Admin"
8⤵
PID:2028

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" +r +s
8⤵
- Views/modifies file attributes
PID:2376

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r Administrators
8⤵
PID:1612

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c Administrators:CI
8⤵
PID:1832

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r Administrator
8⤵
PID:1248

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r users
8⤵
PID:2348

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r system
8⤵
PID:3140

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r everyone
8⤵
PID:212

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r user
8⤵
PID:3936

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r "Power Users"
8⤵
PID:3508

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt" /e /c /r "Admin"
8⤵
PID:3424

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
8⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Runs .reg file with regedit
PID:1700

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\MYShowIeLinkIe6.reg
8⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:2036

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\MyShowIeLinkIe7.reg
8⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:2268

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\search.reg
8⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:960

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\.reg
8⤵
- Modifies registry class
- Runs .reg file with regedit
PID:1092

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\AddRight.reg
8⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:724

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
8⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Runs .reg file with regedit
PID:3752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\reg.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\xcopy.exe
xcopy /c /q /y /i XlKankan.dll C:\Windows\system32
7⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Enumerates system info in registry
PID:2268

C:\Windows\SysWOW64\regedit.exe
regedit /s regBHO.reg
7⤵
- Installs/modifies Browser Helper Object
- Runs .reg file with regedit
PID:4084

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s XlKankan.dll
7⤵
- Loads dropped DLL
- Modifies registry class
PID:4164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe
"C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe"
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1440

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "flashget" /d "c:\windows\20221124\p8qo8c2mgc5vfqhv\smss.exe " /f
6⤵
- Adds Run key to start application
PID:2700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe.bat" "
4⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe.bat" "
2⤵
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Admin\AppData\Local\Temp\6fdd97ca703c12628b3eb0cb3a0bed5daf10c76a1619613c563aa07cc8f63665.exe.bat

Filesize
525B

MD5
0655f0b8663745e1751b0e4d8d0ec644

SHA1
682760597b10726dee68e95fd2421a1e76a11d87

SHA256
0c42e52dde6c45cc49d48b668bb2221c980726a228c1fc15eb0e4dd69a17af8c

SHA512
7eaee8dd4241cdb385356f0869497bae240fca2be74cc50acbbed2acd3749fd1d3078e629749950ae2890a0f43416c101507f47f6aceb624beafe81446108b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe

Filesize
125KB

MD5
ff6177534593a05bf753480352e30067

SHA1
69e9c9b8a94390b7d7639dfb21022247002ad285

SHA256
9b1810688f64818a3b1e6e9d0c292cc25f0e13ddd8b5a29d7f895316c0298d84

SHA512
9e6b2e618adfbf2e1d678c6d0c7d560517a3004e598da6623a3d56445ded1a6fe97524fbeccc8c5ca954b0f3b5e57530424423a0640fbe4257f405d634ab594b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe

Filesize
125KB

MD5
ff6177534593a05bf753480352e30067

SHA1
69e9c9b8a94390b7d7639dfb21022247002ad285

SHA256
9b1810688f64818a3b1e6e9d0c292cc25f0e13ddd8b5a29d7f895316c0298d84

SHA512
9e6b2e618adfbf2e1d678c6d0c7d560517a3004e598da6623a3d56445ded1a6fe97524fbeccc8c5ca954b0f3b5e57530424423a0640fbe4257f405d634ab594b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe.bat

Filesize
329B

MD5
5513062b1c4bbc107aceb59aafd0f110

SHA1
324886fc4cd6e381e31e59af011f169a0a975059

SHA256
43b2309a03022657474d3a0de8c603ac7c65a8a536853155c46acd871898b197

SHA512
e7442139ceb2b19275982b7b063bf599ab202e5ab7c947159638711e11cc7d8d7b2dbfd003ecb1b7a9c7d55d229e16d575fbe730b1997c8a466f2e3e76afc583

Download Submit
C:\Users\Admin\AppData\Local\Temp\VRr85ImhQE22RXj.exe.bat

Filesize
207B

MD5
aac512700019cbf843458abbc09e4ba8

SHA1
f058a7a8aec59cd62a2d76fbeffb0d18f88a9744

SHA256
a2e80f3867353adc5a11107063dd17ce3d8d4fb5c1c6c12eb1f1f90aba58f266

SHA512
d98b547bdda1751a6cf15dcf708d24d2dc8b81cf54d780daa2ac060841d7a437a92e1348936146541bb8e6008d4c92c9fb3ddf7bcbc5acc799c2ca3ac3a3e457

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Public\Desktop\Internet Explorer.tt

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Users\Public\Desktop\ÌØÉ«¹ºÎï.bt

Filesize
8B

MD5
e51f9cdcf7efb98e0859c9f85ce367e2

SHA1
02a5a939959597a5bbadc703fddff668aa98360d

SHA256
044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33

SHA512
0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026

Download Submit
C:\Windows\.reg

Filesize
1KB

MD5
83c46421efb4018f90bfcc3b9e9a9ae1

SHA1
b53f71770cdeb7fb2bec00ae8f7e60e3a0c9d9fd

SHA256
cad1ab956b211364ec3cf02eb0713308d46cbb925a06a24f3ff1f195f7586d81

SHA512
584683b3b6b1278cf215f0c8e6ae0d50f58799fdd369aad9b64080990babeabcdb68f9af988601f5ef188c7c05c4188ce034a890d5205106320b5cee4a658227

Download Submit
C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe

Filesize
44KB

MD5
efbbd019efdd4af36da57cdae9553db2

SHA1
135afd51b152d44ee2f2c32a9d6fba1ae9a3d547

SHA256
11ec2a51ff5bf8b7e9c5a66a73fc10370c005fd4094b6522a2a0042f8683a2e8

SHA512
ff970d6780562820f98e083ac0e9af64582a76c4fe31392316cf9f925a70e122e80b24417187e83149d9c39391a017d09eb4603f81db49e809b31463557e6414

Download Submit
C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe

Filesize
44KB

MD5
efbbd019efdd4af36da57cdae9553db2

SHA1
135afd51b152d44ee2f2c32a9d6fba1ae9a3d547

SHA256
11ec2a51ff5bf8b7e9c5a66a73fc10370c005fd4094b6522a2a0042f8683a2e8

SHA512
ff970d6780562820f98e083ac0e9af64582a76c4fe31392316cf9f925a70e122e80b24417187e83149d9c39391a017d09eb4603f81db49e809b31463557e6414

Download Submit
C:\Windows\20221124\8t528n58Odc88t55\DownFiles.exe.bat

Filesize
198B

MD5
4cc3740adc54ca5d8ca0066fd85294c4

SHA1
90f1bc0219605dcc5ff3624c5c4370531d17dd7e

SHA256
3cafc880b113637be7fadc130420581cc6ccc7fcd97862d363397435f757fbd2

SHA512
52fdf750097a662400e7a12d5787f355386e1905adb779f6c7a54a7d759b79fb6d7f227ea635ba323042208389fd69268d6c85e09a021338e83acb628cbeaf67

Download Submit
C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe

Filesize
16.1MB

MD5
c5a70a6f5073ab6f002b136392467534

SHA1
f61760bf28d706f1a92a7214c8ec90876921ea91

SHA256
5640f4a31b05f4631420467ab8e8ace764589edbb641c3b50d2aa9b7ba10533c

SHA512
55ceb0480d741423379afc5525d38e7f49fe068d067532d6a93b10d0a06395c02d32ef838aef6ecb32cdd9bdff01b2f81005b8e021dc923ad65aa1ef7d4fc21c

Download Submit
C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe

Filesize
16.1MB

MD5
c5a70a6f5073ab6f002b136392467534

SHA1
f61760bf28d706f1a92a7214c8ec90876921ea91

SHA256
5640f4a31b05f4631420467ab8e8ace764589edbb641c3b50d2aa9b7ba10533c

SHA512
55ceb0480d741423379afc5525d38e7f49fe068d067532d6a93b10d0a06395c02d32ef838aef6ecb32cdd9bdff01b2f81005b8e021dc923ad65aa1ef7d4fc21c

Download Submit
C:\Windows\20221124\p8qo8C2MGC5VfQHV\smss.exe.bat

Filesize
183B

MD5
51d467a5583e579fbe6c03b8b51ebeb9

SHA1
7838c4258d014446496c653372e4d2117c877e5e

SHA256
8d2508fc24726c9ea7c86ece677586225201cf78155b83998f963314ad7905e3

SHA512
71131ca24719bfdc1ce35cacda24b7bd40c55324a8ac66264cc664fe7c0268781d3226cb06b653848829c87504a8b1471ab8830d7d047039d8ed2cc619a191bc

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\Script.vbs.bat

Filesize
214B

MD5
250da300fde210459624d3eca296a9e0

SHA1
ab046fa129b46224e6a0cd23c4127fa77e418e45

SHA256
eb017991ce2953d727cca5eaab051af483582c5e8079ca5c384863aa3ea4114b

SHA512
55e2469764637f750f8f53a4d92ff4c68214d35674906c9441fa02d1451f60d7fd96147ede61a7c7f7d5f81df0d507df9a51e2bb4d4c06ab7c093faae7a72931

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\reg.bat

Filesize
130B

MD5
d426a1646ddadd0e41ff5358eeceb3c4

SHA1
69e585d10ad1f4d03a4ceec7f4e336951e10406f

SHA256
86861d7856b53976d754875343237f55e63ca5580db3e57f6ffbbc86977ef573

SHA512
401c3aa8a1a426cb7c6fdfc0e0cd5da193abb8c44c17143996e57838060f22601c51fc3a3da915d0ac3a3f7a70a217fa9576c575bc9f5a30b542c9a5a206dd97

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\regBHO.reg

Filesize
356B

MD5
b93db4ec7eba064cbd7336085953cce9

SHA1
79b458e4b5c974ce2361b103905a941eae0210b9

SHA256
2b6fb4f8615a821498deb27a55261d482fcf97a1dbe8143d233ee7d1b9b63dac

SHA512
420819a9aeeed54337aaabe2f4cf5f0f6b91cda6bacc5eae496320e2d22cc4eafccef7e38d4085d868ab28177889bcbf025f496c14b5df0384bc93ad14d591a6

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe

Filesize
14KB

MD5
3dcd78c7a89db1d3203982b46802c9c0

SHA1
2795ad8b0083111f8a28534a12cb9cdb5a689a53

SHA256
79999072a577af5028f1b6bca397a0320850495b4d0f203704e4be4ba3554f36

SHA512
47dbec94a55bdc33097827f302850e6653cc86794c5e942697f8ccd0ee03b20209242712b4b05e6fccdf4ac8359540e35af519bfdff44766ea4483c7b0bd98af

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe

Filesize
14KB

MD5
3dcd78c7a89db1d3203982b46802c9c0

SHA1
2795ad8b0083111f8a28534a12cb9cdb5a689a53

SHA256
79999072a577af5028f1b6bca397a0320850495b4d0f203704e4be4ba3554f36

SHA512
47dbec94a55bdc33097827f302850e6653cc86794c5e942697f8ccd0ee03b20209242712b4b05e6fccdf4ac8359540e35af519bfdff44766ea4483c7b0bd98af

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.exe.bat

Filesize
210B

MD5
ce7f2282783c1a7c0994655ca3b9f46d

SHA1
5d9929fe9db485d503ec191ab125f6b8e89e1c6c

SHA256
72c1cbfc270bf157e212971358ac1c6143eac2f5012be951bdc689ba161892a0

SHA512
f8941b380295c815258882b320d7e603116a632250013cd9cb40401edc669b9520436a8a65052e24d684841ff705d9c4be5f8716c546a00f0c61db18e43dd931

Download Submit
C:\Windows\20221124\sEaRI8lhum8yC5Y2\script\script.vbs

Filesize
74KB

MD5
702245640f514bb93f4da64d3760e7fd

SHA1
38248ceea943ce18dab4a4d4c824b589b91b927e

SHA256
035d3cdd61620aab302839c3f98d6e8919823b87179ff4777f5d54fa98fef3fa

SHA512
4f1bb0d5314f1263e3518e4eaaccf7c76d7750a5d78c11b2c38a17a2ec52c76d622a95dcc58353cc35fbef6281e32157be5f3ce0e1f7f821af5109d5bdb0a223

Download Submit
C:\Windows\AddRight.reg

Filesize
592B

MD5
53d75aea40be26a09d46f220accfb528

SHA1
82e1a094df1d4137697dfeb9f6b77b877d77ef8a

SHA256
a86cc1150a07bef8f91c426568651eae78be6af0ba06fc067014d6a9fb2c52c2

SHA512
1151e563503ef2841c8a052f0166565238fb86359ac4ded9939e77438e1efccc8d43d767e4dd59502dad4e0b38bf1bda7616254acbeb2b1ac07b2d30b0df3736

Download Submit
C:\Windows\MYShowIeLinkIe6.reg

Filesize
7KB

MD5
4f69fa82c34c91514da21a5933644af8

SHA1
e131f57f41ce95b46195d460852718b83517579a

SHA256
7cd8b741bfaee5cd14779b69d71b362aac4c928097c6b4af8ce0ce16bde52a46

SHA512
276588f960d28023febd87873c7852f401ab6ebfb3d90bf8b21b1998949d8ab00badb42d1a05934587aa6b4ad0ab06a3d649dcdb70f384ca70339049243463c4

Download Submit
C:\Windows\MyShowIeLinkIe7.reg

Filesize
9KB

MD5
dbd46bf2e72f6dfbb21295f4e3066d47

SHA1
cdd6ca2f6455c1e528c40a520bcdb8669df8f548

SHA256
71927f4f034db038385346e34209ad069139f54d73bae34bfaf4f29b7010fc6b

SHA512
ad013387a0c7608375b7a3c5fdb27f0d9e79b051d84b1ee9221346499f386d30473b5e2727f6a4e8a8122cf8ac2d473a5ce5e368e62da09441ed48e5c088bd11

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
150B

MD5
51bfbcf7a9f642b8a95dfdaa48fff3ea

SHA1
0dc72c74fbb86832e990a778bb17b07cb02c933f

SHA256
6b20504950977a8cec63b574b64f2dc72f6366a9bcb9838c2e2044429ae0380a

SHA512
4ba1b7985624738329ae11adf59291fd6b90df8dcd1e0f53d13e6cf0533a5a23d76e579d0974e15570fad95da497331fa031f8db81a18ddd5b1ded991d2dacbe

Download Submit
C:\Windows\SetWindowsIndex.reg

Filesize
150B

MD5
51bfbcf7a9f642b8a95dfdaa48fff3ea

SHA1
0dc72c74fbb86832e990a778bb17b07cb02c933f

SHA256
6b20504950977a8cec63b574b64f2dc72f6366a9bcb9838c2e2044429ae0380a

SHA512
4ba1b7985624738329ae11adf59291fd6b90df8dcd1e0f53d13e6cf0533a5a23d76e579d0974e15570fad95da497331fa031f8db81a18ddd5b1ded991d2dacbe

Download Submit
C:\Windows\SysWOW64\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\SysWOW64\XlKankan.dll

Filesize
28KB

MD5
ce8f0033298014df0508a996b638b5eb

SHA1
610f52ba70f2053a9a4dba08d88a3f97243aa3d6

SHA256
9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466

SHA512
216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200

Download Submit
C:\Windows\search.reg

Filesize
1KB

MD5
8e2ec860bfbd9aa37ea44e51d559ea9b

SHA1
f64e2891ec34d4909f28b2ae14c0a9f712a0e29c

SHA256
ff8d92c2bbe81ccfa1a6ac46ac66e7b42dc4fd18a27924c2e6511d2579f092df

SHA512
ad551272a90d79aef258d22680c07a5d81b0b31e1712dc2a60ac2c67f8af13f18c3a5f99f8408231bc5bb4f68882a5d75ed5c0e203059575eea5940d8b841dc1

Download Submit
C:\Windows\userid.txt

Filesize
4B

MD5
5e76bef6e019b2541ff53db39f407a98

SHA1
3cd969896e49a6d3326acf33f0c2d8cc38b0d06a

SHA256
fddc599a3afe6c68b8098f7ef3db02335f7e398e3c0bd34b663f04f424886aeb

SHA512
5598677e4a2224825bb36dfdccc9be7ccc3f01b8ab84bc3b6c8f23f23d5f9b4fdc5aa17ec2c0640ac35d6cbdb60971c0dd9a8ddac560b41047cca26aa55baf31

Download Submit
C:\Windows\userid.txt

Filesize
4B

MD5
5e76bef6e019b2541ff53db39f407a98

SHA1
3cd969896e49a6d3326acf33f0c2d8cc38b0d06a

SHA256
fddc599a3afe6c68b8098f7ef3db02335f7e398e3c0bd34b663f04f424886aeb

SHA512
5598677e4a2224825bb36dfdccc9be7ccc3f01b8ab84bc3b6c8f23f23d5f9b4fdc5aa17ec2c0640ac35d6cbdb60971c0dd9a8ddac560b41047cca26aa55baf31

Download Submit
C:\Windows\userid.txt

Filesize
4B

MD5
5e76bef6e019b2541ff53db39f407a98

SHA1
3cd969896e49a6d3326acf33f0c2d8cc38b0d06a

SHA256
fddc599a3afe6c68b8098f7ef3db02335f7e398e3c0bd34b663f04f424886aeb

SHA512
5598677e4a2224825bb36dfdccc9be7ccc3f01b8ab84bc3b6c8f23f23d5f9b4fdc5aa17ec2c0640ac35d6cbdb60971c0dd9a8ddac560b41047cca26aa55baf31

Download Submit
memory/212-214-0x0000000000000000-mapping.dmp

Download
memory/364-192-0x0000000000000000-mapping.dmp

Download
memory/364-147-0x0000000000000000-mapping.dmp

Download
memory/376-175-0x0000000000000000-mapping.dmp

Download
memory/620-181-0x0000000000000000-mapping.dmp

Download
memory/724-228-0x0000000000000000-mapping.dmp

Download
memory/724-204-0x0000000000000000-mapping.dmp

Download
memory/884-145-0x0000000000000000-mapping.dmp

Download
memory/960-224-0x0000000000000000-mapping.dmp

Download
memory/1092-226-0x0000000000000000-mapping.dmp

Download
memory/1152-174-0x0000000000000000-mapping.dmp

Download
memory/1164-188-0x0000000000000000-mapping.dmp

Download
memory/1248-210-0x0000000000000000-mapping.dmp

Download
memory/1304-178-0x0000000000000000-mapping.dmp

Download
memory/1336-195-0x0000000000000000-mapping.dmp

Download
memory/1376-190-0x0000000000000000-mapping.dmp

Download
memory/1440-166-0x0000000000000000-mapping.dmp

Download
memory/1516-133-0x0000000000000000-mapping.dmp

Download
memory/1612-208-0x0000000000000000-mapping.dmp

Download
memory/1612-153-0x0000000000000000-mapping.dmp

Download
memory/1672-198-0x0000000000000000-mapping.dmp

Download
memory/1700-218-0x0000000000000000-mapping.dmp

Download
memory/1832-209-0x0000000000000000-mapping.dmp

Download
memory/1840-163-0x0000000000000000-mapping.dmp

Download
memory/1852-202-0x0000000000000000-mapping.dmp

Download
memory/1904-203-0x0000000000000000-mapping.dmp

Download
memory/2028-206-0x0000000000000000-mapping.dmp

Download
memory/2036-220-0x0000000000000000-mapping.dmp

Download
memory/2060-205-0x0000000000000000-mapping.dmp

Download
memory/2168-183-0x0000000000000000-mapping.dmp

Download
memory/2188-200-0x0000000000000000-mapping.dmp

Download
memory/2196-194-0x0000000000000000-mapping.dmp

Download
memory/2268-155-0x0000000000000000-mapping.dmp

Download
memory/2268-222-0x0000000000000000-mapping.dmp

Download
memory/2348-211-0x0000000000000000-mapping.dmp

Download
memory/2376-207-0x0000000000000000-mapping.dmp

Download
memory/2580-156-0x0000000000000000-mapping.dmp

Download
memory/2700-177-0x0000000000000000-mapping.dmp

Download
memory/2700-232-0x0000000000000000-mapping.dmp

Download
memory/3032-136-0x0000000000000000-mapping.dmp

Download
memory/3124-189-0x0000000000000000-mapping.dmp

Download
memory/3140-213-0x0000000000000000-mapping.dmp

Download
memory/3372-182-0x0000000000000000-mapping.dmp

Download
memory/3384-141-0x0000000000000000-mapping.dmp

Download
memory/3424-217-0x0000000000000000-mapping.dmp

Download
memory/3468-185-0x0000000000000000-mapping.dmp

Download
memory/3508-216-0x0000000000000000-mapping.dmp

Download
memory/3512-151-0x0000000000000000-mapping.dmp

Download
memory/3608-139-0x0000000000000000-mapping.dmp

Download
memory/3752-230-0x0000000000000000-mapping.dmp

Download
memory/3772-193-0x0000000000000000-mapping.dmp

Download
memory/3884-196-0x0000000000000000-mapping.dmp

Download
memory/3928-180-0x0000000000000000-mapping.dmp

Download
memory/3936-215-0x0000000000000000-mapping.dmp

Download
memory/4056-186-0x0000000000000000-mapping.dmp

Download
memory/4076-176-0x0000000000000000-mapping.dmp

Download
memory/4084-162-0x0000000000000000-mapping.dmp

Download
memory/4164-165-0x0000000000000000-mapping.dmp

Download
memory/4240-197-0x0000000000000000-mapping.dmp

Download
memory/4436-199-0x0000000000000000-mapping.dmp

Download
memory/4696-158-0x0000000000000000-mapping.dmp

Download
memory/4816-187-0x0000000000000000-mapping.dmp

Download
memory/5068-132-0x0000000000000000-mapping.dmp

Download
memory/5084-179-0x0000000000000000-mapping.dmp

Download