0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ = "shdocvw.dll"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ThreadingModel = "Apartment"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SHServicePlatform\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\SHApp\\7.0.18.0\\shsp.dll"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2952-237-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/2952-296-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/2952-400-0x0000000000400000-0x00000000005EC000-memory.dmp	upx

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9377ltzn_mgaz_01.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	yt906554.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHPlayer.exe

Loads dropped DLL 64 IoCs

pid	Process
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
4596	9377ltzn_mgaz_01.exe
4596	9377ltzn_mgaz_01.exe
4596	9377ltzn_mgaz_01.exe
4596	9377ltzn_mgaz_01.exe
4596	9377ltzn_mgaz_01.exe
4596	9377ltzn_mgaz_01.exe
4596	9377ltzn_mgaz_01.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4416	ServiceClient.exe
4416	ServiceClient.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4416	ServiceClient.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1160	LTLogger.exe
5104	ServiceClient.exe
5104	ServiceClient.exe
5104	ServiceClient.exe
4520	ResideClient.exe
4520	ResideClient.exe
4520	ResideClient.exe
4520	ResideClient.exe
4520	ResideClient.exe
4152	Kele55.exe
4152	Kele55.exe
4152	Kele55.exe
4152	Kele55.exe
4152	Kele55.exe
756	Update.exe
756	Update.exe
756	Update.exe
756	Update.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
4152	Kele55.exe
4152	Kele55.exe
4336	Update.exe
4336	Update.exe
4336	Update.exe
4336	Update.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
4152	Kele55.exe
4152	Kele55.exe
4152	Kele55.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LeiTing = "\"C:\\Program Files (x86)\\9377À×öªÖ®Å\u00ad\\9377À×öªÖ®Å\u00adÂÌÉ«°æ.lnk\""	9377ltzn_mgaz_01.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	install1078565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\""	install1078565.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SHPlayer = "\"C:\\Users\\Admin\\AppData\\Roaming\\????\\7.0.18.0\\SHPlayer.exe\" /auto"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	9377ltzn_mgaz_01.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Rising\RAV\desktop.ini	install1078565.exe

Enumerates connected drives 3 TTPs 9 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\E:	ResideClient.exe
File opened (read-only)	\??\F:	Kele55.exe
File opened (read-only)	\??\E:	Kele55.exe
File opened (read-only)	\??\F:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\E:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\G:	ResideClient.exe
File opened (read-only)	\??\F:	ResideClient.exe
File opened (read-only)	\??\G:	Kele55.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	hy906557.exe
File opened for modification	\??\PhysicalDrive0	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	\??\PhysicalDrive0	install1078565.exe
File opened for modification	\??\PhysicalDrive0	hy906557.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\navigate_up[1].xml	ravmond.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ravmond.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ravmond.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ravmond.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ravmond.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\navigate_sign[1].xml	ravmond.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rising\RAV\selfmon.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\data\HTML\img\lock_cl.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\Rising.ico	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\RsBaseNetWrapper.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\12345678.000	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Rising.ico	install1078565.exe
File created	C:\Program Files (x86)\Kele55\data\HTML\img\liebiao_di.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\procenv.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\LogDc.bmp	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\Cloudv3.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\cloudnotifier.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Flash\E521.swf	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\comx3.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\XMLS\setup.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\localopt.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\DnsSession.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\rsdk.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\CLOUDQRY.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\repairmanager.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\cloudstore.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Skin\worldBugleIcon.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVLOG\rslog.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVDEFDB\mondef.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\defmon.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\CfgDll.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\Setup.exe	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDQRY\CLOUDQRY.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\sysmon.sys	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RavSetup.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\Rising.ico	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\RsMain.ico	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Skin\DefFace.bmp	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Kele55\Update\UpdateSetUp.exe	Update.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD950\CHT.lag	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\rsmginfo.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rssqlite.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\x64\adefmon.mond	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CompsVer.inf	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\mergexml.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\bawhite.dat	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\CfgDll.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\popwndexe.exe	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\popwndexe.exe	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RAVBASE.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\rscombas.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\XMLS\HOOKBASE.xml	install1078565.exe
File created	C:\Program Files (x86)\Kele55\msvcr71.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\kguard.sys	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\moncom08.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDV3\localopt.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\NetConfig.ini	install1078565.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Flash\E6666.swf	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\data\11.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\syslay.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMON\mond.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\bacore.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\popwndexe.exe	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\kguard_if.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\cloudstore.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\uprsmon.dat	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\Label.dat	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\MONBASEDUI.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\cloudnotifier.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\comx3.dll	install1078565.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\gsyspd.log	ResideClient.exe
File opened for modification	C:\WINDOWS\msgpi.log	ResideClient.exe
File opened for modification	C:\WINDOWS\gsyspd.log	Kele55.exe
File opened for modification	C:\WINDOWS\msgpi.log	Kele55.exe
File opened for modification	C:\WINDOWS\gsyspd.log	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\WINDOWS\msgpi.log	KeLe2014Beta3.6.2Promote0326_20090195130.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

resource	yara_rule
behavioral2/files/0x00040000000162a5-146.dat	nsis_installer_1
behavioral2/files/0x00040000000162a5-146.dat	nsis_installer_2
behavioral2/files/0x00040000000162a5-143.dat	nsis_installer_1
behavioral2/files/0x00040000000162a5-143.dat	nsis_installer_2
behavioral2/files/0x000200000001e82b-156.dat	nsis_installer_1
behavioral2/files/0x000200000001e82b-156.dat	nsis_installer_2
behavioral2/files/0x000200000001e82b-155.dat	nsis_installer_1
behavioral2/files/0x000200000001e82b-155.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SHPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SHPlayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\kele55.com	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Kele55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\chat.kele55.com	Kele55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	LTLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	LTLogger.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	LTLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com\NumberOfSubdomains = "1"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\chat.kele55.com\ = "63"	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com\Total = "63"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	LTLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	Kele55.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ravmond.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ravmond.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ravmond.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ravmond.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ravmond.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m3u\ = "媒体文件(.m3u)"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.vob\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m3u\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.bmp\Shell\使用搜狐看图打开\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.m2ts\ = "SHPlayer.bak"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.fli	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.difox	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.difox\ = "SHPlayer.difox"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.png\shell\ = "open"	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4891BA68-4A0E-435D-9082-3ED9C5F66FCD}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.asf\	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.flc\shell\open	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ram	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\monShowName = "tEfdIHOSYCwdEzI/QDsCUARA"	install1078565.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m4v\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2ts\Shell\使用搜狐影音播放\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3455FF69-FE20-4E00-BE84-5256F068B715}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2t\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ram\shell\open\command	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.jpeg	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.tga\Shell\使用搜狐看图打开\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SoHuVA.SoHuDector\ = "SHDetectorCOM Class"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.mrw\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.tga\shell\open\ = "使用搜狐看图打开"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.png\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.gif\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2ts\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\Skin\\Default\\icon\\logo.ico"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\ = "使用搜狐看图打开"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C104B2ED-79DB-445D-B13C-65A8BDE47DF9}	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C104B2ED-79DB-445D-B13C-65A8BDE47DF9}\TypeLib	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE1E6174-2BB5-48C7-9413-B7D307A45A87}\TypeLib\Version = "1.0"	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ram\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.f4v\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.mpeg\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.arw\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4891BA68-4A0E-435D-9082-3ED9C5F66FCD}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.heic\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.mrw\ = "SHImageViewer.bak"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE1E6174-2BB5-48C7-9413-B7D307A45A87}\TypeLib\Version = "1.0"	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2t\DefaultIcon	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mpeg\shell	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.cr2\shell\open\ = "使用搜狐看图打开"	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.svg\Shell\使用搜狐看图打开	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E1236F-2C87-4C63-AC75-290DB2E94448}\InprocServer32	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\Instance\InitPropertyBag\Target = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2t\ = "媒体文件(.m2t)"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.asf\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2t	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.tif\Shell\使用搜狐看图打开\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe \"%1\""	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.m2ts\ = "SHPlayer.m2ts"	FileAssociationsTool.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.mp4\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m3u\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.svg\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.crw\Shell\使用搜狐看图打开\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\ShellFolder\Attributes = "0"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DDBA5B-45A9-4B01-AFBC-75EAB53ED66B}\ = "ISHDetectorCOM"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\ = "媒体文件"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\ = "open"	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.jpeg\DefaultIcon	SHImageViewer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5104	ServiceClient.exe
5104	ServiceClient.exe
896	msedge.exe
896	msedge.exe
2372	yt906554.exe
2372	yt906554.exe
5104	ServiceClient.exe
5104	ServiceClient.exe
4520	ResideClient.exe
4520	ResideClient.exe
3540	msedge.exe
3540	msedge.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
3772	hy906557.exe
5104	ServiceClient.exe
5104	ServiceClient.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4520	ResideClient.exe
4520	ResideClient.exe
2952	install1078565.exe
5104	ServiceClient.exe
5104	ServiceClient.exe
4520	ResideClient.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	5216	RsMgrSvc.exe
Token: SeDebugPrivilege	2952	install1078565.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe
Token: 33	220	ravmond.exe
Token: SeIncBasePriorityPrivilege	220	ravmond.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3540	msedge.exe
3652	hy906557.exe
3540	msedge.exe
3540	msedge.exe
5596	SHPlayer.exe
5596	SHPlayer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5596	SHPlayer.exe
5596	SHPlayer.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4416	ServiceClient.exe
1160	LTLogger.exe
1160	LTLogger.exe
5104	ServiceClient.exe
4520	ResideClient.exe
4152	Kele55.exe
756	Update.exe
4336	Update.exe
4152	Kele55.exe
3672	hy906557.exe
3672	hy906557.exe
4724	hy906557.exe
4724	hy906557.exe
4152	Kele55.exe
4152	Kele55.exe
5592	FileAssociationsTool.exe
6040	FileAssociationsTool.exe
5980	FileAssociationsTool.exe
5184	FileAssociationsTool.exe
4620	FileAssociationsTool.exe
5676	FileAssociationsTool.exe
5308	FileAssociationsTool.exe
5372	FileAssociationsTool.exe
5596	SHPlayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4904	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	81
PID 2012 wrote to memory of 4904	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	81
PID 2012 wrote to memory of 4904	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	81
PID 4904 wrote to memory of 1540	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	82
PID 4904 wrote to memory of 1540	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	82
PID 4904 wrote to memory of 1540	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	82
PID 2012 wrote to memory of 4596	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	83
PID 2012 wrote to memory of 4596	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	83
PID 2012 wrote to memory of 4596	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	83
PID 2012 wrote to memory of 3540	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	84
PID 2012 wrote to memory of 3540	2012	0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe	84
PID 3540 wrote to memory of 3060	3540	msedge.exe	85
PID 3540 wrote to memory of 3060	3540	msedge.exe	85
PID 4904 wrote to memory of 4416	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	86
PID 4904 wrote to memory of 4416	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	86
PID 4904 wrote to memory of 4416	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	86
PID 4416 wrote to memory of 32	4416	ServiceClient.exe	87
PID 4416 wrote to memory of 32	4416	ServiceClient.exe	87
PID 4416 wrote to memory of 32	4416	ServiceClient.exe	87
PID 32 wrote to memory of 2332	32	net.exe	89
PID 32 wrote to memory of 2332	32	net.exe	89
PID 32 wrote to memory of 2332	32	net.exe	89
PID 4596 wrote to memory of 1160	4596	9377ltzn_mgaz_01.exe	90
PID 4596 wrote to memory of 1160	4596	9377ltzn_mgaz_01.exe	90
PID 4596 wrote to memory of 1160	4596	9377ltzn_mgaz_01.exe	90
PID 5104 wrote to memory of 4520	5104	ServiceClient.exe	94
PID 5104 wrote to memory of 4520	5104	ServiceClient.exe	94
PID 5104 wrote to memory of 4520	5104	ServiceClient.exe	94
PID 4904 wrote to memory of 4152	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	95
PID 4904 wrote to memory of 4152	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	95
PID 4904 wrote to memory of 4152	4904	KeLe2014Beta3.6.2Promote0326_20090195130.exe	95
PID 4152 wrote to memory of 756	4152	Kele55.exe	96
PID 4152 wrote to memory of 756	4152	Kele55.exe	96
PID 4152 wrote to memory of 756	4152	Kele55.exe	96
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97
PID 3540 wrote to memory of 2420	3540	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe
"C:\Users\Admin\AppData\Local\Temp\0a602b01456b035ddaa89a15e397d79b16a89cd0540674aff695adf7bc7f1e52.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\nsuD316.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
  KeLe2014Beta3.6.2Promote0326_20090195130.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\nseF96A.tmp\GGExit.exe
    "C:\Users\Admin\AppData\Local\Temp\nseF96A.tmp\GGExit.exe" 5
    3⤵
    - Executes dropped EXE
    PID:1540
- - C:\Program Files (x86)\Kele55\ServiceClient.exe
    "C:\Program Files (x86)\Kele55\ServiceClient.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\net.exe
      net start GuaGua-Service
      4⤵
      Suspicious use of WriteProcessMemory
      PID:32
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start GuaGua-Service
        5⤵
        
        PID:2332
- - C:\Program Files (x86)\Kele55\Kele55.exe
    "C:\Program Files (x86)\Kele55\Kele55.exe" -autorunroom
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Program Files (x86)\Kele55\Update.exe
      "C:\Program Files (x86)\Kele55\Update.exe" 4.358 1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:756
  - - C:\Program Files (x86)\Kele55\Update.exe
      "C:\Program Files (x86)\Kele55\Update.exe" 4.358
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:4336
- C:\Users\Admin\AppData\Local\Temp\nsuD316.tmp\9377ltzn_mgaz_01.exe
  9377ltzn_mgaz_01.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files (x86)\9377À×öªÖ®Å\LTLogger.exe
    "C:\Program Files (x86)\9377À×öªÖ®Å\LTLogger.exe" "C:\Program Files (x86)\9377À×öªÖ®Å\LeiTing.dll" 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.caogenchuangyejidi.com/MGE2MDJiMDE0NTZiMDM1ZGRhYTg5YTE1ZTM5N2Q3OWIxNmE4OWNkMDU0MDY3NGFmZjY5NWFkZjdiYzdmMWU1Mi5leGU=/40.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa084946f8,0x7ffa08494708,0x7ffa08494718
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff7ca345460,0x7ff7ca345470,0x7ff7ca345480
      4⤵
      PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4100 /prefetch:8
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3348 /prefetch:8
    3⤵
    PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3360 /prefetch:8
    3⤵
    PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,576993304697014569,15895716300024748496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3308 /prefetch:2
    3⤵
    PID:6240
- C:\Users\Admin\AppData\Local\Temp\nsuD316.tmp\install1078565.exe
  install1078565.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- - C:\Program Files (x86)\Rising\RSD\popwndexe.exe
    "C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
    3⤵
    - Executes dropped EXE
    PID:5344
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s RavExt64.dll
    3⤵
    PID:6016
- - C:\Program Files (x86)\Rising\RAV\ravmond.exe
    "C:\Program Files (x86)\Rising\RAV\ravmond.exe" -srv setup /SLIENCE
    3⤵
    - Executes dropped EXE
    PID:2060
- C:\Users\Admin\AppData\Local\Temp\nsuD316.tmp\yt906554.exe
  yt906554.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- - C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
    "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" SW_SHOWNORMAL
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3672
- - C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
    "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" /ShowDeskTop
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3652
- - C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
    "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" /autorun /setuprun
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4724
- - C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe
    "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\hy906557\hy906557.exe" /setupsucc
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    PID:3772
- C:\Users\Admin\AppData\Local\Temp\nsuD316.tmp\SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
  SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Sets DLL path for service in the registry
  - Checks computer location settings
  - Modifies registry class
  PID:5612
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHBHO.dll"
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHIEPlugin.dll"
    3⤵
    - Modifies registry class
    PID:6088
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\syspin.exe
    C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\syspin.exe "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe" c:5386
    3⤵
    - Executes dropped EXE
    PID:1652
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /EnableAutoRun
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5592
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ModifyMainShortcut
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6040
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /F
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5980
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /TSet
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5184
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe" /AddAssoc
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5668
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4620
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ReleaseSWF
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5676
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /InstallSuccess 0
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5308
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5372
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe
    C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe /auto
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5596
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=2492 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:3656
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
        
        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_ac42e72d-3c0a-4993-bb51-f5ca41abaae2_20221128_200238.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-38.log,
        5⤵
        Executes dropped EXE
        
        PID:5700
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=utility --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=3360 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:5260
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=3416 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:432
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:2352
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=2712 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:6196
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
        
        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_0be3b5c4-ca43-4257-b061-00875a173159_20221128_200238.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-38.log,
        5⤵
        Executes dropped EXE
        
        PID:6240
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:6252
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=3144 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:6380
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
        
        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_335858d8-0dc5-4d7b-9cc4-272d3d98c94b_20221128_200239.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-39.log,
        5⤵
        Executes dropped EXE
        
        PID:6480
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=4908 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:6628
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2484,13216813321347049665,7362364241304388342,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=audio --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\20-02-36.log" --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:6828

C:\Program Files (x86)\Kele55\ServiceClient.exe
"C:\Program Files (x86)\Kele55\ServiceClient.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Kele55\ResideClient.exe
  ResideClient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Program Files (x86)\Rising\RAV\ravmond.exe
"C:\Program Files (x86)\Rising\RAV\ravmond.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs shsp
1⤵
- Modifies data under HKEY_USERS
PID:3444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x514
1⤵
PID:6908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery