Overview
overview
10Static
static
7Windows优...EL.dll
windows7-x64
10Windows优...EL.dll
windows10-2004-x64
10Windows优...ay.exe
windows7-x64
6Windows优...ay.exe
windows10-2004-x64
6Windows优...mb.dll
windows7-x64
10Windows优...mb.dll
windows10-2004-x64
10Windows优...ll.exe
windows7-x64
1Windows优...ll.exe
windows10-2004-x64
1Windows优...��.url
windows7-x64
1Windows优...��.url
windows10-2004-x64
1Windows优...��.url
windows7-x64
1Windows优...��.url
windows10-2004-x64
1Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
14/06/2024, 14:21
Behavioral task
behavioral1
Sample
Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
Windows优化卫士 6.0/YiXinSafe/mb.dll
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
Windows优化卫士 6.0/YiXinSafe/mb.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral7
Sample
Windows优化卫士 6.0/nsUninstall.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Windows优化卫士 6.0/nsUninstall.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Windows优化卫士 6.0/华彩联盟论坛.url
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Windows优化卫士 6.0/华彩联盟论坛.url
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Windows优化卫士 6.0/华彩软件站-使用必读.url
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Windows优化卫士 6.0/华彩软件站-使用必读.url
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
- Size 1.3MB
- Sample240614-rpcgmathka
- SHA256 3ba42211ae2fdf56182fef332f11c9d1b9ed5ed5fd57838b604418aa8cfc322e
- MD5 58853c966aa4475abcb37f8a89bfad63
- SHA1 09dc7d7c796414b754a5fa9687005a6a1f8856bc
- SHA512 6f3ac48dc9eb6dbb190c3fe676ec6e8a0ec88d9e8846d8bff8cebe9e47785d514445c07316f0f09f9aefd849ab7c309b8659017d65868d0c3f29f2d1cf4039a4
- SSDEEP 12288:48eTUxcn2d9sxrIJpUcGP76kXTbgHKHhea0lfshdcC:48OUxn7sdIJCc27r/lHhn0dwf
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YiXinPCTray = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows???? 6.0\\YiXinSafe\\YiXinPCTray.exe" YiXinPCTray.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\ = "ÌÔ±¦ÈÈÂôÉ̳Ç" YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0} YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance YiXinPCTray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Command = "ÌÔ±¦ÈÈÂôÉ̳Ç" YiXinPCTray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\InfoTip = "ÌÔ±¦Íø - ÌÔ£¡ÎÒϲ»¶" YiXinPCTray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Param1 = "http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_13711484_0_0" YiXinPCTray.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 1 2224 YiXinPCTray.exe Token: SeCreateTokenPrivilege 2224 YiXinPCTray.exe Token: SeAssignPrimaryTokenPrivilege 2224 YiXinPCTray.exe Token: SeLockMemoryPrivilege 2224 YiXinPCTray.exe Token: SeIncreaseQuotaPrivilege 2224 YiXinPCTray.exe Token: SeMachineAccountPrivilege 2224 YiXinPCTray.exe Token: SeTcbPrivilege 2224 YiXinPCTray.exe Token: SeSecurityPrivilege 2224 YiXinPCTray.exe Token: SeTakeOwnershipPrivilege 2224 YiXinPCTray.exe Token: SeLoadDriverPrivilege 2224 YiXinPCTray.exe Token: SeSystemProfilePrivilege 2224 YiXinPCTray.exe Token: SeSystemtimePrivilege 2224 YiXinPCTray.exe Token: SeProfSingleProcessPrivilege 2224 YiXinPCTray.exe Token: SeIncBasePriorityPrivilege 2224 YiXinPCTray.exe Token: SeCreatePagefilePrivilege 2224 YiXinPCTray.exe Token: SeCreatePermanentPrivilege 2224 YiXinPCTray.exe Token: SeBackupPrivilege 2224 YiXinPCTray.exe Token: SeRestorePrivilege 2224 YiXinPCTray.exe Token: SeShutdownPrivilege 2224 YiXinPCTray.exe Token: SeDebugPrivilege 2224 YiXinPCTray.exe Token: SeAuditPrivilege 2224 YiXinPCTray.exe Token: SeSystemEnvironmentPrivilege 2224 YiXinPCTray.exe Token: SeChangeNotifyPrivilege 2224 YiXinPCTray.exe Token: SeRemoteShutdownPrivilege 2224 YiXinPCTray.exe Token: SeUndockPrivilege 2224 YiXinPCTray.exe Token: SeSyncAgentPrivilege 2224 YiXinPCTray.exe Token: SeEnableDelegationPrivilege 2224 YiXinPCTray.exe Token: SeManageVolumePrivilege 2224 YiXinPCTray.exe Token: SeImpersonatePrivilege 2224 YiXinPCTray.exe Token: SeCreateGlobalPrivilege 2224 YiXinPCTray.exe Token: 1 2224 YiXinPCTray.exe Token: SeCreateTokenPrivilege 2224 YiXinPCTray.exe Token: SeAssignPrimaryTokenPrivilege 2224 YiXinPCTray.exe Token: SeLockMemoryPrivilege 2224 YiXinPCTray.exe Token: SeIncreaseQuotaPrivilege 2224 YiXinPCTray.exe Token: SeMachineAccountPrivilege 2224 YiXinPCTray.exe Token: SeTcbPrivilege 2224 YiXinPCTray.exe Token: SeSecurityPrivilege 2224 YiXinPCTray.exe Token: SeTakeOwnershipPrivilege 2224 YiXinPCTray.exe Token: SeLoadDriverPrivilege 2224 YiXinPCTray.exe Token: SeSystemProfilePrivilege 2224 YiXinPCTray.exe Token: SeSystemtimePrivilege 2224 YiXinPCTray.exe Token: SeProfSingleProcessPrivilege 2224 YiXinPCTray.exe Token: SeIncBasePriorityPrivilege 2224 YiXinPCTray.exe Token: SeCreatePagefilePrivilege 2224 YiXinPCTray.exe Token: SeCreatePermanentPrivilege 2224 YiXinPCTray.exe Token: SeBackupPrivilege 2224 YiXinPCTray.exe Token: SeRestorePrivilege 2224 YiXinPCTray.exe Token: SeShutdownPrivilege 2224 YiXinPCTray.exe Token: SeDebugPrivilege 2224 YiXinPCTray.exe Token: SeAuditPrivilege 2224 YiXinPCTray.exe Token: SeSystemEnvironmentPrivilege 2224 YiXinPCTray.exe Token: SeChangeNotifyPrivilege 2224 YiXinPCTray.exe Token: SeRemoteShutdownPrivilege 2224 YiXinPCTray.exe Token: SeUndockPrivilege 2224 YiXinPCTray.exe Token: SeSyncAgentPrivilege 2224 YiXinPCTray.exe Token: SeEnableDelegationPrivilege 2224 YiXinPCTray.exe Token: SeManageVolumePrivilege 2224 YiXinPCTray.exe Token: SeImpersonatePrivilege 2224 YiXinPCTray.exe Token: SeCreateGlobalPrivilege 2224 YiXinPCTray.exe Token: 1 2224 YiXinPCTray.exe Token: SeCreateTokenPrivilege 2224 YiXinPCTray.exe Token: SeAssignPrimaryTokenPrivilege 2224 YiXinPCTray.exe Token: SeLockMemoryPrivilege 2224 YiXinPCTray.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe 2224 YiXinPCTray.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2224