df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db

Processes:

SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ = "shdocvw.dll"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ThreadingModel = "Apartment"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SHServicePlatform\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\SHApp\\7.0.18.0\\shsp.dll"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3112-260-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/3112-301-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/3112-372-0x0000000000400000-0x00000000005EC000-memory.dmp	upx

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

9377sssg_Y_mgaz_01.exeyt906554.exeSoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exeSHCefEngine.exeSHPlayer.exeSHCefEngine.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9377sssg_Y_mgaz_01.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	yt906554.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHPlayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe

Loads dropped DLL 64 IoCs

Processes:

df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exeKeLe2014Beta3.6.2Promote0326_20090195130.exe9377sssg_Y_mgaz_01.exeServiceClient.exeServiceClient.exeResideClient.exeKele55.exeSSLogger.exeUpdate.exeSSLogger.exeUpdate.exe

pid	process
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4748	9377sssg_Y_mgaz_01.exe
4748	9377sssg_Y_mgaz_01.exe
4748	9377sssg_Y_mgaz_01.exe
4748	9377sssg_Y_mgaz_01.exe
4748	9377sssg_Y_mgaz_01.exe
4748	9377sssg_Y_mgaz_01.exe
4748	9377sssg_Y_mgaz_01.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
2092	ServiceClient.exe
2092	ServiceClient.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
2092	ServiceClient.exe
4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe
848	ServiceClient.exe
848	ServiceClient.exe
848	ServiceClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
2784	Kele55.exe
2784	Kele55.exe
2784	Kele55.exe
2784	Kele55.exe
2784	Kele55.exe
364	SSLogger.exe
3032	Update.exe
3032	Update.exe
3032	Update.exe
544	SSLogger.exe
3032	Update.exe
2784	Kele55.exe
2784	Kele55.exe
4864	Update.exe
4864	Update.exe
4864	Update.exe
4864	Update.exe
2784	Kele55.exe
2784	Kele55.exe
2784	Kele55.exe
2784	Kele55.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

install1078565.exemsedge.exeFileAssociationsTool.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	install1078565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\""	install1078565.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SHPlayer = "\"C:\\Users\\Admin\\AppData\\Roaming\\????\\7.0.18.0\\SHPlayer.exe\" /auto"	FileAssociationsTool.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

install1078565.exe

description ioc process

File opened for modification C:\Program Files (x86)\Rising\RAV\desktop.ini install1078565.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Rising\RAV\desktop.ini	install1078565.exe

Enumerates connected drives 3 TTPs 9 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ResideClient.exeKeLe2014Beta3.6.2Promote0326_20090195130.exeKele55.exe

description	ioc	process
File opened (read-only)	\??\E:	ResideClient.exe
File opened (read-only)	\??\F:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\E:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\G:	ResideClient.exe
File opened (read-only)	\??\F:	ResideClient.exe
File opened (read-only)	\??\G:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\G:	Kele55.exe
File opened (read-only)	\??\F:	Kele55.exe
File opened (read-only)	\??\E:	Kele55.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

hy906557.exehy906557.exehy906557.exeResideClient.exeinstall1078565.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	hy906557.exe
File opened for modification	\??\PhysicalDrive0	hy906557.exe
File opened for modification	\??\PhysicalDrive0	hy906557.exe
File opened for modification	\??\PhysicalDrive0	ResideClient.exe
File opened for modification	\??\PhysicalDrive0	install1078565.exe

Drops file in Program Files directory 64 IoCs

Processes:

KeLe2014Beta3.6.2Promote0326_20090195130.exeinstall1078565.exe9377sssg_Y_mgaz_01.exeravmond.exe

description	ioc	process
File created	C:\Program Files (x86)\Kele55\data\common.dat	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\traywnd.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RsMain.ico	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVCONFIG\ravcfg.xml	install1078565.exe
File created	C:\Program Files (x86)\Kele55\IconToolTip.exe	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMON\mondcoms.xml	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\RSMONDEF.xml	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Rising.ico	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\Proccomm.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RsSmall.bmp	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\selfmon.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\Skin\DefFace_16.bmp	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\XMLS\RSSetup.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\64\rsutils.sys	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\hookbase.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\msvcr90.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\SSLogger.ini	9377sssg_Y_mgaz_01.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\adefmon.mond	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Flash\E1314.png	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ServiceClient.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\update.xml	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD1252\Eng.lag	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMAINDUI\RAVMAINDUI.xml	install1078565.exe
File created	C:\Program Files (x86)\Kele55\RecommendInfo.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ResideClient.exe	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsAppMgr.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\CfgDll.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\repairmanager.mond	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\msvcp90.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\syslay.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\RSD936\CHS.lag	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\cloudwork.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\mondef.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\Skin\LoadHtml\css\style.css	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\CCenter.db	ravmond.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\VcrMediaLib.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\data\FlowerData.dat	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\data\SvrAddr000.dat	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDQRY\cloudnet.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\RSDK.xml	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Skin\PrivteMic.bmp	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Skin\gift_sel_icon.png	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\RSD936\CHS.lag	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\RstoreDll.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\x64\adefmon.mond	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\monrule.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\Microsoft.VC90.CRT.manifest	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rscommx2.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Setup.exe	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\64\rsndisp.sys	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Label.dat	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rscombas.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\uprsmon.dat	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Flash\E99.png	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Skin\Alarm.png	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\data\HTML\img\close.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD1252\Eng.lag	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\localopt.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\ui\snin.htm	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVLOG\RAVLOG.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\rsutils_if.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\rsxml3w.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\Kele55.exe	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\data\8.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe

Drops file in Windows directory 6 IoCs

Processes:

ResideClient.exeKeLe2014Beta3.6.2Promote0326_20090195130.exeKele55.exe

description	ioc	process
File opened for modification	C:\WINDOWS\gsyspd.log	ResideClient.exe
File opened for modification	C:\WINDOWS\msgpi.log	ResideClient.exe
File opened for modification	C:\WINDOWS\gsyspd.log	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\WINDOWS\msgpi.log	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\WINDOWS\gsyspd.log	Kele55.exe
File opened for modification	C:\WINDOWS\msgpi.log	Kele55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\9377sssg_Y_mgaz_01.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\9377sssg_Y_mgaz_01.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\9377sssg_Y_mgaz_01.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\9377sssg_Y_mgaz_01.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

SHPlayer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SHPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SHPlayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

Processes:

SSLogger.exeSSLogger.exeKele55.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	SSLogger.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	SSLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	SSLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	SSLogger.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	SSLogger.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Kele55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\kele55.com	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com\NumberOfSubdomains = "1"	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	Kele55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	SSLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\chat.kele55.com	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com\Total = "63"	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	SSLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\chat.kele55.com\ = "63"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	SSLogger.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

ravmond.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ravmond.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe

Modifies registry class 64 IoCs

Processes:

SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exeFileAssociationsTool.exeFileAssociationsTool.exeKeLe2014Beta3.6.2Promote0326_20090195130.exeregsvr32.exeFileAssociationsTool.exeSHImageViewer.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2v\Shell\使用搜狐影音播放\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.vob\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.mp4\ = "SHPlayer.bak"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.rm\shell\open\command	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DECF57E2-63D5-4A3B-8973-1E9153BA11A9}\InprocServer32	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3455FF69-FE20-4E00-BE84-5256F068B715}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.mpeg\ = "SHPlayer.mpeg"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.qt\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.avi\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2p\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.tif\Shell\使用搜狐看图打开\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe \"%1\""	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m4v\shell\ = "open"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.avi\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\Skin\\Default\\icon\\avi.ico"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\command	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.gif\Shell\使用搜狐看图打开\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DDBA5B-45A9-4B01-AFBC-75EAB53ED66B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2p\ = "SHPlayer.bak"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.3gp\ = "SHPlayer.3gp"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.heic\shell\open\command	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.svg\shell\open	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ram	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.tiff\Shell\使用搜狐看图打开\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F06D7B1-F9F3-4D23-B02C-C64C2A9A1745}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2v\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.3gp\shell\open\command	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.rm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.jpg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2ts\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.gif\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.nef\shell\open\command	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\ = "图片文件"	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2t\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.mpeg\Shell\使用搜狐影音播放\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.m4v\	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.fli	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mp4\shell\ = "open"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mov\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mov\shell\open	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.jpeg\Shell\使用搜狐看图打开\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ico\Shell\使用搜狐看图打开\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe \"%1\""	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\ = "使用搜狐看图打开"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2ts\shell\open	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.webm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.asf\ = "媒体文件(.asf)"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.png\shell	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.tif\Shell\使用搜狐看图打开	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.ts\	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mp4	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.jpg\shell\open\command	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.bmp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.3gpp\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.avi\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mkv\ = "媒体文件(.mkv)"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mov	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.asf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\Skin\\Default\\icon\\asf.ico"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.png\shell\ = "open"	SHImageViewer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ServiceClient.exemsedge.exemsedge.exeResideClient.exeyt906554.exehy906557.exehy906557.exehy906557.exe

pid	process
848	ServiceClient.exe
848	ServiceClient.exe
4336	msedge.exe
4336	msedge.exe
2064	msedge.exe
2064	msedge.exe
848	ServiceClient.exe
848	ServiceClient.exe
848	ServiceClient.exe
848	ServiceClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
848	ServiceClient.exe
848	ServiceClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
2300	yt906554.exe
2300	yt906554.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
5452	hy906557.exe
848	ServiceClient.exe
848	ServiceClient.exe
4352	ResideClient.exe
4352	ResideClient.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
5352	hy906557.exe
5352	hy906557.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid process

648
648
648
648
648
648
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2064 msedge.exe
2064 msedge.exe
2064 msedge.exe
2064 msedge.exe
2064 msedge.exe
2064 msedge.exe

pid	process
648
648
648
648
648
648

pid	process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

RsMgrSvc.exeinstall1078565.exeravmond.exe

description	pid	process
Token: SeBackupPrivilege	6000	RsMgrSvc.exe
Token: SeDebugPrivilege	3112	install1078565.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe
Token: 33	5680	ravmond.exe
Token: SeIncBasePriorityPrivilege	5680	ravmond.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

msedge.exehy906557.exeSHPlayer.exe

pid process

2064 msedge.exe
2064 msedge.exe
2064 msedge.exe
5376 hy906557.exe
4604 SHPlayer.exe
4604 SHPlayer.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

SHPlayer.exe

pid process

4604 SHPlayer.exe
4604 SHPlayer.exe

pid	process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
5376	hy906557.exe
4604	SHPlayer.exe
4604	SHPlayer.exe

pid	process
4604	SHPlayer.exe
4604	SHPlayer.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

ServiceClient.exeServiceClient.exeResideClient.exeKele55.exeSSLogger.exeSSLogger.exeUpdate.exeUpdate.exehy906557.exehy906557.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeFileAssociationsTool.exeSHPlayer.exe

pid	process
2092	ServiceClient.exe
848	ServiceClient.exe
4352	ResideClient.exe
2784	Kele55.exe
364	SSLogger.exe
364	SSLogger.exe
544	SSLogger.exe
544	SSLogger.exe
3032	Update.exe
4864	Update.exe
2784	Kele55.exe
2784	Kele55.exe
2784	Kele55.exe
5352	hy906557.exe
5352	hy906557.exe
5436	hy906557.exe
5436	hy906557.exe
3572	FileAssociationsTool.exe
1328	FileAssociationsTool.exe
2088	FileAssociationsTool.exe
5580	FileAssociationsTool.exe
3480	FileAssociationsTool.exe
6052	FileAssociationsTool.exe
3804	FileAssociationsTool.exe
748	FileAssociationsTool.exe
4604	SHPlayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exeKeLe2014Beta3.6.2Promote0326_20090195130.exemsedge.exeServiceClient.exenet.exeServiceClient.exe

description	pid	process	target process
PID 4920 wrote to memory of 4972	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	KeLe2014Beta3.6.2Promote0326_20090195130.exe
PID 4920 wrote to memory of 4972	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	KeLe2014Beta3.6.2Promote0326_20090195130.exe
PID 4920 wrote to memory of 4972	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	KeLe2014Beta3.6.2Promote0326_20090195130.exe
PID 4972 wrote to memory of 1288	4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe	GGExit.exe
PID 4972 wrote to memory of 1288	4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe	GGExit.exe
PID 4972 wrote to memory of 1288	4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe	GGExit.exe
PID 4920 wrote to memory of 4748	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	9377sssg_Y_mgaz_01.exe
PID 4920 wrote to memory of 4748	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	9377sssg_Y_mgaz_01.exe
PID 4920 wrote to memory of 4748	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	9377sssg_Y_mgaz_01.exe
PID 4920 wrote to memory of 2064	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	msedge.exe
PID 4920 wrote to memory of 2064	4920	df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe	msedge.exe
PID 2064 wrote to memory of 3632	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 3632	2064	msedge.exe	msedge.exe
PID 4972 wrote to memory of 2092	4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe	ServiceClient.exe
PID 4972 wrote to memory of 2092	4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe	ServiceClient.exe
PID 4972 wrote to memory of 2092	4972	KeLe2014Beta3.6.2Promote0326_20090195130.exe	ServiceClient.exe
PID 2092 wrote to memory of 4676	2092	ServiceClient.exe	net.exe
PID 2092 wrote to memory of 4676	2092	ServiceClient.exe	net.exe
PID 2092 wrote to memory of 4676	2092	ServiceClient.exe	net.exe
PID 4676 wrote to memory of 4704	4676	net.exe	net1.exe
PID 4676 wrote to memory of 4704	4676	net.exe	net1.exe
PID 4676 wrote to memory of 4704	4676	net.exe	net1.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4324	2064	msedge.exe	msedge.exe
PID 848 wrote to memory of 4352	848	ServiceClient.exe	ResideClient.exe
PID 848 wrote to memory of 4352	848	ServiceClient.exe	ResideClient.exe

C:\Users\Admin\AppData\Local\Temp\df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe
"C:\Users\Admin\AppData\Local\Temp\df76a911e1268d1c84a1ddd5c1b6508e60264f1af43754c7f6527db08104e7db.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
KeLe2014Beta3.6.2Promote0326_20090195130.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\nsbD817.tmp\GGExit.exe
"C:\Users\Admin\AppData\Local\Temp\nsbD817.tmp\GGExit.exe" 5
3⤵
- Executes dropped EXE
PID:1288

C:\Program Files (x86)\Kele55\ServiceClient.exe
"C:\Program Files (x86)\Kele55\ServiceClient.exe" -i
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\net.exe
net start GuaGua-Service
4⤵
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start GuaGua-Service
5⤵
PID:4704

C:\Program Files (x86)\Kele55\Kele55.exe
"C:\Program Files (x86)\Kele55\Kele55.exe" -autorunroom
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2784

C:\Program Files (x86)\Kele55\Update.exe
"C:\Program Files (x86)\Kele55\Update.exe" 4.358 1
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Program Files (x86)\Kele55\Update.exe
"C:\Program Files (x86)\Kele55\Update.exe" 4.358
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\9377sssg_Y_mgaz_01.exe
9377sssg_Y_mgaz_01.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
PID:4748

C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\SSLogger.exe
"C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\SSLogger.exe" "C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\ShengShi.dll" 2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:364

C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\SSLogger.exe
"C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\SSLogger.exe" "C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2\ShengShi.dll" 2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.caogenchuangyejidi.com/ZGY3NmE5MTFlMTI2OGQxYzg0YTFkZGQ1YzFiNjUwOGU2MDI2NGYxYWY0Mzc1NGM3ZjY1MjdkYjA4MTA0ZTdkYi5leGU=/40.html
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0x8,0x104,0x7fffe9ed46f8,0x7fffe9ed4708,0x7fffe9ed4718
3⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
3⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
3⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
3⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
3⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4520 /prefetch:8
3⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5572 /prefetch:8
3⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
3⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
3⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
3⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
3⤵
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
3⤵
PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff6c90c5460,0x7ff6c90c5470,0x7ff6c90c5480
4⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
3⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:8
3⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6068 /prefetch:8
3⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1044 /prefetch:8
3⤵
PID:6272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2600 /prefetch:2
3⤵
PID:6548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,141332897049491856,13846935462859495660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1260 /prefetch:8
3⤵
PID:6616

C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\install1078565.exe
install1078565.exe
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Program Files (x86)\Rising\RSD\popwndexe.exe
"C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
3⤵
- Executes dropped EXE
PID:4704

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s RavExt64.dll
3⤵
PID:1620

C:\Program Files (x86)\Rising\RAV\ravmond.exe
"C:\Program Files (x86)\Rising\RAV\ravmond.exe" -srv setup /SLIENCE
3⤵
- Executes dropped EXE
PID:1328

C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\yt906554.exe
yt906554.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2300

C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
"C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" SW_SHOWNORMAL
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5352

C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
"C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" /ShowDeskTop
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5376

C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
"C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" /autorun /setuprun
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
"C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" /setupsucc
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:5452

C:\Users\Admin\AppData\Local\Temp\nsrB349.tmp\SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Sets DLL path for service in the registry
- Checks computer location settings
- Modifies registry class
PID:5560

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHBHO.dll"
3⤵
PID:2596

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHIEPlugin.dll"
3⤵
- Modifies registry class
PID:3480

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\syspin.exe
C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\syspin.exe "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe" c:5386
3⤵
- Executes dropped EXE
PID:1884

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /EnableAutoRun
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3572

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ModifyMainShortcut
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1328

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /F
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /TSet
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5580

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe" /AddAssoc
3⤵
- Executes dropped EXE
- Modifies registry class
PID:3676

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ReleaseSWF
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6052

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /InstallSuccess 0
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3804

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:748

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe
C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe /auto
3⤵
- Executes dropped EXE
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4604

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=2500 /prefetch:2
4⤵
- Executes dropped EXE
PID:5416

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_44865bf1-526b-496b-ad4f-e63bcae7dccf_20221128_145124.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log,
5⤵
- Executes dropped EXE
PID:1328

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=utility --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=3496 /prefetch:8
4⤵
- Executes dropped EXE
PID:4548

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=3520 /prefetch:8
4⤵
- Executes dropped EXE
PID:1860

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=4036 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:5656

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=2716 /prefetch:2
4⤵
- Executes dropped EXE
PID:5764

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_6cb6c3ff-dbe4-4ba7-a477-7e311a589cdb_20221128_145126.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-26.log,
5⤵
- Executes dropped EXE
PID:3320

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=2896 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:5560

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=3716 /prefetch:2
4⤵
- Executes dropped EXE
PID:5172

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_4f0abec8-8afb-49c7-a7fd-4b3f77292a90_20221128_145127.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-27.log,
5⤵
- Executes dropped EXE
PID:5608

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=4948 /prefetch:2
4⤵
- Executes dropped EXE
PID:6156

C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
"C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2488,3350180900843785923,16035981543118557205,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=audio --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\14-51-24.log" --mojo-platform-channel-handle=5612 /prefetch:8
4⤵
- Executes dropped EXE
PID:6400

C:\Program Files (x86)\Kele55\ServiceClient.exe
"C:\Program Files (x86)\Kele55\ServiceClient.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848

C:\Program Files (x86)\Kele55\ResideClient.exe
ResideClient.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Program Files (x86)\Rising\RAV\ravmond.exe
"C:\Program Files (x86)\Rising\RAV\ravmond.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs shsp
1⤵
- Modifies data under HKEY_USERS
PID:3108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x498
1⤵
PID:6460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery