Overview
overview
10Static
static
7Windows优...EL.dll
windows7-x64
10Windows优...EL.dll
windows10-2004-x64
10Windows优...ay.exe
windows7-x64
6Windows优...ay.exe
windows10-2004-x64
6Windows优...mb.dll
windows7-x64
10Windows优...mb.dll
windows10-2004-x64
10Windows优...ll.exe
windows7-x64
1Windows优...ll.exe
windows10-2004-x64
1Windows优...��.url
windows7-x64
1Windows优...��.url
windows10-2004-x64
1Windows优...��.url
windows7-x64
1Windows优...��.url
windows10-2004-x64
1Analysis
- max time kernel
144s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 14:21
Behavioral task
behavioral1
Sample
Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
Windows优化卫士 6.0/YiXinSafe/mb.dll
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
Windows优化卫士 6.0/YiXinSafe/mb.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral7
Sample
Windows优化卫士 6.0/nsUninstall.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Windows优化卫士 6.0/nsUninstall.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Windows优化卫士 6.0/华彩联盟论坛.url
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Windows优化卫士 6.0/华彩联盟论坛.url
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Windows优化卫士 6.0/华彩软件站-使用必读.url
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Windows优化卫士 6.0/华彩软件站-使用必读.url
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
- Size 1.3MB
- Sample240614-rpcgmathka
- SHA256 3ba42211ae2fdf56182fef332f11c9d1b9ed5ed5fd57838b604418aa8cfc322e
- MD5 58853c966aa4475abcb37f8a89bfad63
- SHA1 09dc7d7c796414b754a5fa9687005a6a1f8856bc
- SHA512 6f3ac48dc9eb6dbb190c3fe676ec6e8a0ec88d9e8846d8bff8cebe9e47785d514445c07316f0f09f9aefd849ab7c309b8659017d65868d0c3f29f2d1cf4039a4
- SSDEEP 12288:48eTUxcn2d9sxrIJpUcGP76kXTbgHKHhea0lfshdcC:48OUxn7sdIJCc27r/lHhn0dwf
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YiXinPCTray = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows???? 6.0\\YiXinSafe\\YiXinPCTray.exe" YiXinPCTray.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Command = "ÌÔ±¦ÈÈÂôÉ̳Ç" YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0} YiXinPCTray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\ = "ÌÔ±¦ÈÈÂôÉ̳Ç" YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag YiXinPCTray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\InfoTip = "ÌÔ±¦Íø - ÌÔ£¡ÎÒϲ»¶" YiXinPCTray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Param1 = "http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_13711484_0_0" YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID YiXinPCTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance YiXinPCTray.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 1 4812 YiXinPCTray.exe Token: SeCreateTokenPrivilege 4812 YiXinPCTray.exe Token: SeAssignPrimaryTokenPrivilege 4812 YiXinPCTray.exe Token: SeLockMemoryPrivilege 4812 YiXinPCTray.exe Token: SeIncreaseQuotaPrivilege 4812 YiXinPCTray.exe Token: SeMachineAccountPrivilege 4812 YiXinPCTray.exe Token: SeTcbPrivilege 4812 YiXinPCTray.exe Token: SeSecurityPrivilege 4812 YiXinPCTray.exe Token: SeTakeOwnershipPrivilege 4812 YiXinPCTray.exe Token: SeLoadDriverPrivilege 4812 YiXinPCTray.exe Token: SeSystemProfilePrivilege 4812 YiXinPCTray.exe Token: SeSystemtimePrivilege 4812 YiXinPCTray.exe Token: SeProfSingleProcessPrivilege 4812 YiXinPCTray.exe Token: SeIncBasePriorityPrivilege 4812 YiXinPCTray.exe Token: SeCreatePagefilePrivilege 4812 YiXinPCTray.exe Token: SeCreatePermanentPrivilege 4812 YiXinPCTray.exe Token: SeBackupPrivilege 4812 YiXinPCTray.exe Token: SeRestorePrivilege 4812 YiXinPCTray.exe Token: SeShutdownPrivilege 4812 YiXinPCTray.exe Token: SeDebugPrivilege 4812 YiXinPCTray.exe Token: SeAuditPrivilege 4812 YiXinPCTray.exe Token: SeSystemEnvironmentPrivilege 4812 YiXinPCTray.exe Token: SeChangeNotifyPrivilege 4812 YiXinPCTray.exe Token: SeRemoteShutdownPrivilege 4812 YiXinPCTray.exe Token: SeUndockPrivilege 4812 YiXinPCTray.exe Token: SeSyncAgentPrivilege 4812 YiXinPCTray.exe Token: SeEnableDelegationPrivilege 4812 YiXinPCTray.exe Token: SeManageVolumePrivilege 4812 YiXinPCTray.exe Token: SeImpersonatePrivilege 4812 YiXinPCTray.exe Token: SeCreateGlobalPrivilege 4812 YiXinPCTray.exe Token: 1 4812 YiXinPCTray.exe Token: SeCreateTokenPrivilege 4812 YiXinPCTray.exe Token: SeAssignPrimaryTokenPrivilege 4812 YiXinPCTray.exe Token: SeLockMemoryPrivilege 4812 YiXinPCTray.exe Token: SeIncreaseQuotaPrivilege 4812 YiXinPCTray.exe Token: SeMachineAccountPrivilege 4812 YiXinPCTray.exe Token: SeTcbPrivilege 4812 YiXinPCTray.exe Token: SeSecurityPrivilege 4812 YiXinPCTray.exe Token: SeTakeOwnershipPrivilege 4812 YiXinPCTray.exe Token: SeLoadDriverPrivilege 4812 YiXinPCTray.exe Token: SeSystemProfilePrivilege 4812 YiXinPCTray.exe Token: SeSystemtimePrivilege 4812 YiXinPCTray.exe Token: SeProfSingleProcessPrivilege 4812 YiXinPCTray.exe Token: SeIncBasePriorityPrivilege 4812 YiXinPCTray.exe Token: SeCreatePagefilePrivilege 4812 YiXinPCTray.exe Token: SeCreatePermanentPrivilege 4812 YiXinPCTray.exe Token: SeBackupPrivilege 4812 YiXinPCTray.exe Token: SeRestorePrivilege 4812 YiXinPCTray.exe Token: SeShutdownPrivilege 4812 YiXinPCTray.exe Token: SeDebugPrivilege 4812 YiXinPCTray.exe Token: SeAuditPrivilege 4812 YiXinPCTray.exe Token: SeSystemEnvironmentPrivilege 4812 YiXinPCTray.exe Token: SeChangeNotifyPrivilege 4812 YiXinPCTray.exe Token: SeRemoteShutdownPrivilege 4812 YiXinPCTray.exe Token: SeUndockPrivilege 4812 YiXinPCTray.exe Token: SeSyncAgentPrivilege 4812 YiXinPCTray.exe Token: SeEnableDelegationPrivilege 4812 YiXinPCTray.exe Token: SeManageVolumePrivilege 4812 YiXinPCTray.exe Token: SeImpersonatePrivilege 4812 YiXinPCTray.exe Token: SeCreateGlobalPrivilege 4812 YiXinPCTray.exe Token: 1 4812 YiXinPCTray.exe Token: SeCreateTokenPrivilege 4812 YiXinPCTray.exe Token: SeAssignPrimaryTokenPrivilege 4812 YiXinPCTray.exe Token: SeLockMemoryPrivilege 4812 YiXinPCTray.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe 4812 YiXinPCTray.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4812