Malware Analysis Report

2024-09-09 16:48

Sample ID 240614-rpcgmathka
Target aa26ec34162e38147b948b39b362d476_JaffaCakes118
SHA256 df77dd69b8085bcd0bac0a6493b405b2cb4faab5a8394e9c25dcb594c8735c54
Tags
ramnit banker spyware stealer trojan upx worm persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df77dd69b8085bcd0bac0a6493b405b2cb4faab5a8394e9c25dcb594c8735c54

Threat Level: Known bad

The file aa26ec34162e38147b948b39b362d476_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ramnit banker spyware stealer trojan upx worm persistence

Ramnit

Loads dropped DLL

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 14:21

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

57s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩联盟论坛.url"

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩联盟论坛.url"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win7-20240220-en

Max time kernel

134s

Max time network

128s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\mb.dll",#1

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32Srv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32Srv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rundll32Srv.exe C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px1111.tmp C:\Windows\SysWOW64\rundll32Srv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E8AF0B1-2A59-11EF-A5A7-5A32F786089A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424536774" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2704 wrote to memory of 2980 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2704 wrote to memory of 2980 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2704 wrote to memory of 2980 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2704 wrote to memory of 2980 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2980 wrote to memory of 2520 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2980 wrote to memory of 2520 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2980 wrote to memory of 2520 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2980 wrote to memory of 2520 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2520 wrote to memory of 2480 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2480 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2480 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2480 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2480 wrote to memory of 2652 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2480 wrote to memory of 2652 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2480 wrote to memory of 2652 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2480 wrote to memory of 2652 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\mb.dll",#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\mb.dll",#1

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.bing.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Windows\SysWOW64\rundll32Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/2520-15-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2520-17-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2704-13-0x0000000010000000-0x0000000010897000-memory.dmp

memory/2980-12-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2704-18-0x0000000010000000-0x0000000010897000-memory.dmp

memory/2704-19-0x0000000010000000-0x0000000010897000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab29A3.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar2A74.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ddbb35dff58395c9c8b69267719db673
SHA1 5a34ae68224cb9c762646178b1b73f87f45ae512
SHA256 e82562e3da0c48b97de0560fe5288d5be558b71c554495ced2c8ed9d7857edae
SHA512 b7bc213f10c9c686e7e58d1ebd7a23e947d962bda6555bde29665a068a3f8968d707abd4bb18dd3172ca6bc0c5be2625c50b3d6d2c743fc1e70d04be97876439

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4b30dc11886292a15d1606fd28ac9a5
SHA1 bb785ccf98c11c2ecf76b2566171a35fe17dc221
SHA256 fc48676977770514ab76528d70f2368263ee54ec35b46cf5ddffb01d10e60410
SHA512 5114942b8c14d558b8a38902a5eb0e8976797890f797e11b08056b8f675c7cc4281e50163670c58076067633258dfc048f0a0f2f211e0e17f80210fc207db0d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7afa167c1feb43d30c0ed36821f6d332
SHA1 338514941dad27c15934eb8225c9d499b6707212
SHA256 2cb275b17b766da0edb705d9dcfe2ff6780401980ec7efcd9d38d0585aa7cdb1
SHA512 6c106f963ded0c6f4541e6505933defb887fdca17b1be70b3248fd08151f9c6356cd46f8476646455882b1091004bd3d6624fcb28b0412393eb656b118fc0c70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fabce99b9045c7bd07b990e720a68130
SHA1 2b4ce15a5e63eec3ce4c073a2db15f4487e75f93
SHA256 21084b2a4a63a9a638d9cffaced6b1d076efd7c13407e49dceb75c70b903239f
SHA512 8d97112792e6fc6ab7e4cddae022c759002d10e4be2ef77c52f76013c7b56a2bb882714460261ffa5ac1ac70cae09dcd9f805a60120b64087f27ee2d0ee226fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3af2ec7146381cd0ec83f031f861a012
SHA1 bd1f6cfa2944b5ae7bce2d888dbff2ada8069445
SHA256 68d9bac3f6e830243d5c309896dd5a8744427c8f6aaeca77676083ab959b2527
SHA512 33c238ca7670d1b55732528f5324eb7a38159b0f869bebcad43415ff53e12541503cc18b107ad0bd748854568cce58eac58177575dd7cfc3ed0f04be08489126

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 536afe2c126df875324cc6add30c7f5e
SHA1 6a9b70d1780557dfa4d1c85360abf271614aaff5
SHA256 aa6169040540b6557c83ed286c87e5e9ffd91e3c28a27e80924f649c1e6f67a8
SHA512 38fa3f3239045186c59efa7cfbfe2c19dc64e6faa8fd4a0d229010f219e4cc8205eb198bde58831df98c819677c16e6ae20dc3d6b9bcfd794a61e82248d3b021

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc8f400cc0780221d0e3d7f1d51ce151
SHA1 1181d5cd9b83111d9e56390395ef516b20c0c940
SHA256 c1b02a2c356c8799f050c964e18660287d729819495531549d3da305ec7cd306
SHA512 531d519a759e0b5f200db7e450fc47a6814bc81f8329cbe658fdb6b66952c2c19d218480113aa39599c9af2f9cf8f379424b394f0ab26bf308717f880ded886e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 517a6742a3f4511d188232931e77d520
SHA1 f923a6d5ffc225c50ac7818bf4e54533d94c99d7
SHA256 d11138dfa8528ca047b0b7e6178e28e0cb5ea703c8f5c01625d2eb73ce345f22
SHA512 3702d67c867a88580f527cd405c980ecfcfec4a5ae9c040573e8529ce2f96850fe565f10f6cd7c25713f32396335fa767847b07940c80cbb3e8a14bd409ff406

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 39026c994cb8ee5a7e6f4757dcc43198
SHA1 aac29d2be8ac1882dffbdeba9c28d7113cdbfa9a
SHA256 7263a748bc3ff89e0cdb4b3895a0bc540a9961049bcc06f95da0f7081e03a131
SHA512 87d80403a87c18971e275740be1b88424e2e379f18eaaf183ae91f73a98004fae6439de88ada73f7e3a0ea9cb449cec96dbb9ef277aa5f957ebfaae59ca2739e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54b7ede7af29e83959d962ffccff53dd
SHA1 5a796de67654a36315ed82bca86f3a282a49a358
SHA256 58b94ab476cf3b665688da0c4940feb0507ca824f3d1bc3af783ee4f0985b508
SHA512 8f8580616f555d6959bf502dc2ef0f2deba75ffff442f7421ad4d7334d4003c4a1bf47c559134229d12de1fac62100d9a2e2019b0547ae66451ce7d05375a5ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 304b8c86117bf26305aaaaa47a3ba301
SHA1 bd92e199c321d78271a2be0701fff4ea2dfbf02d
SHA256 79ee1e5078ecc4cdbd7845f2de201b76ade02c82f70cc9fa69bb971c5a7d8212
SHA512 45dcf124769368b0cdbeae9f7fb1b007ef78b64fc1817b70affebffe0898d33c426f9502a86b355ca3ab15b6be0ea3e0bf03c419bc644f8dddfc933d4b82552f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7248089756141f2a079ee82b55f7bd1d
SHA1 bc51b117384d7b5d0f15fc0ddd1f83a4119e8adb
SHA256 7771392d84279f203d6798afe347bd5f293762555edb80ed04e22b2a72defac0
SHA512 07cb183ae594df9147d59abe6440dd523af3a2ffbb6b636343a78009fe302a8a9755d484e7834cf8bdef2cf9d5b4769ce97e3e47c3674853e60c3d070bdc832c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e953c9e968885167ccef3769fa43e498
SHA1 1f2344764ece6936ac17c1c966963689a503d20d
SHA256 686fa8cb1d793120c9ceaf3a91b7f22a2639a0f0b93698d05033c6bbcd896b98
SHA512 a2eb4a8c99de988de6033cdc52a6cecea4c12006119c2cd174166b9b7430dfd424a55d777e1382b3a9386cb7da34f8256a77bb4dbceda73f28ca4f39201409e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e50c75ec80aeb5cd226cf21d0e12b7dc
SHA1 d4b25cdde4f0c2e6393b38441511b166af5016fd
SHA256 41fa4a0ccc9bed1d7c071d063d693a8d1c8d6b452d9a70ae0442d0e9e3e6d63b
SHA512 5acb2172f57c1e1177b57e025c36e556b24e6cc74554784d52a6f53c46c8875cf2a891192ee9ca9548af9676bb45014627ee354dc6998e5b1946cad99af7e83f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3551003785b9d5404bb652dbff388938
SHA1 bf90a8c09d6ddbb9319c39bde9565056b1cfe712
SHA256 8184d89856f74b09dab59c68216b8a2334eabc4427a205fe6d1f29b43ac8e94d
SHA512 c9bf93536e7523ac7899b34e84d6f1884777d9f78e16e21f846b181be19b156b0ec619e30c5e2f3cb78c16290c976bd34a26c83fec9fb6a5a18575353d1d2189

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59676c573fce640f2a28e39cfe4f5afd
SHA1 d9629e5b1feff3c24cb67fa534f7581cc027d9d1
SHA256 f144b4a64b581c4ed7233d4f590582baa2b41b7fc0a4126e30fb3bc3fdd1efbb
SHA512 8c88f513e77dd0df8205937550a68e2f23a1ef776e82f29ae4610d1c0806260fecee9c5f8c43067bbd4e5b3a77d3f10524b262637054133871da921f7495e475

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7379e038c279d125c5625a77642e49a8
SHA1 629cff4189d92c15fc9ea38555fc6cd479e38aa8
SHA256 0c4d25b82c53201870abc3cbb63cdf83c18bb1d49af2a72f953618385496dd70
SHA512 eaad62f84b09def15acf445205d42b5afad1330c7708dce92be1836c990b9748aa828267f11b84d31f5e6f40347b1da3f1e1eabba4788bf9be348f97e630ee21

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2feec3120f863631e7f9dd95915e3c9
SHA1 de121854dfd6ceb5a031772efe01a6ef2aab641b
SHA256 ab4ec1b413b0865ddffad80817ac18b95abff2a200ad21ac14d24c31c01587ff
SHA512 29d07fdc7b90812a997a40dcd2bd39d345b7bdde170ae2e73d5a24d4faf71e15fb3fc13a6a2462a23f176faf467f32dda7a8dbe362ca2153ba6549ee19c2d24d

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win7-20231129-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\nsUninstall.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\nsUninstall.exe

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\nsUninstall.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.hofosoft.com udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\nsUninstall.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\nsUninstall.exe

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\nsUninstall.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.hofosoft.com udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

101s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩软件站-使用必读.url"

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩软件站-使用必读.url"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.113:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 113.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 114.83.221.88.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win7-20240221-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YiXinPCTray = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows???? 6.0\\YiXinSafe\\YiXinPCTray.exe" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\ = "ÌÔ±¦ÈÈÂôÉ̳Ç" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0} C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Command = "ÌÔ±¦ÈÈÂôÉ̳Ç" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\InfoTip = "ÌÔ±¦Íø - ÌÔ£¡ÎÒϲ»¶" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Param1 = "http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_13711484_0_0" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.microsoft.com udp
SE 23.34.233.128:80 www.microsoft.com tcp
US 8.8.8.8:53 www.baidu.com udp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp
HK 103.235.46.40:80 www.baidu.com tcp

Files

memory/2224-0-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-1-0x0000000010000000-0x0000000010897000-memory.dmp

memory/2224-14-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-41-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-35-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-36-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-37-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-61-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-83-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-81-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-59-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-57-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-53-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-51-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-45-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-38-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-97-0x00000000030A0000-0x00000000034A0000-memory.dmp

memory/2224-109-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-117-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-121-0x00000000030A0000-0x00000000034A0000-memory.dmp

memory/2224-175-0x0000000010000000-0x0000000010897000-memory.dmp

memory/2224-125-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-123-0x00000000030A0000-0x00000000034A0000-memory.dmp

memory/2224-101-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-93-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-91-0x0000000002CB0000-0x0000000002EB0000-memory.dmp

memory/2224-87-0x00000000060A0000-0x00000000068A0000-memory.dmp

memory/2224-249-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-275-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-276-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-277-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-279-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-280-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-281-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-282-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2224-284-0x0000000000400000-0x0000000000588000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YiXinPCTray = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows???? 6.0\\YiXinSafe\\YiXinPCTray.exe" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Command = "ÌÔ±¦ÈÈÂôÉ̳Ç" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0} C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\ = "ÌÔ±¦ÈÈÂôÉ̳Ç" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\InfoTip = "ÌÔ±¦Íø - ÌÔ£¡ÎÒϲ»¶" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Param1 = "http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_13711484_0_0" C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe

"C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\YiXinPCTray.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp

Files

memory/4812-0-0x0000000000400000-0x0000000000588000-memory.dmp

memory/4812-1-0x0000000010000000-0x0000000010897000-memory.dmp

memory/4812-2-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

memory/4812-4-0x0000000000400000-0x0000000000588000-memory.dmp

memory/4812-5-0x0000000010000000-0x0000000010897000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win7-20240508-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩联盟论坛.url"

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩联盟论坛.url"

Network

N/A

Files

memory/2124-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win7-20240611-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩软件站-使用必读.url"

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\华彩软件站-使用必读.url"

Network

N/A

Files

memory/2304-0-0x0000000001D80000-0x0000000001D81000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win7-20240221-en

Max time kernel

140s

Max time network

128s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\SkinH_EL.dll",#1

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32Srv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32Srv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rundll32Srv.exe C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px18AF.tmp C:\Windows\SysWOW64\rundll32Srv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424536774" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E79AAD1-2A59-11EF-86DB-FA8378BF1C4A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1584 wrote to memory of 2188 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2188 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2188 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2188 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2188 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 3040 wrote to memory of 2764 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3040 wrote to memory of 2764 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3040 wrote to memory of 2764 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3040 wrote to memory of 2764 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2764 wrote to memory of 2568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2188 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2188 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2188 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2188 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\SkinH_EL.dll",#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\SkinH_EL.dll",#1

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 248

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.bing.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2188-1-0x0000000010000000-0x000000001004C000-memory.dmp

memory/2188-2-0x0000000010000000-0x000000001004C000-memory.dmp

\Windows\SysWOW64\rundll32Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/2188-4-0x0000000000400000-0x000000000042E000-memory.dmp

memory/3040-23-0x000000007772F000-0x0000000077730000-memory.dmp

memory/3040-20-0x0000000000240000-0x0000000000241000-memory.dmp

memory/3040-22-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2188-13-0x0000000010000000-0x000000001004C000-memory.dmp

memory/2188-12-0x0000000010009000-0x000000001000A000-memory.dmp

memory/2636-11-0x0000000000230000-0x000000000023F000-memory.dmp

memory/2636-10-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab2F7C.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Cab3068.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar307D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 31e87620403d37b1e080809d8254d0ef
SHA1 f400c7169d9a3d4bc5783e237932eb96dcdcb0a9
SHA256 cada7b57a8c7156ea9111eee9127f247a26e2c7f5393d8d2f5dec17ae56b2d28
SHA512 8913876378a9812eec7c02e976901c3dbc0b460b6a1aed32efab58f046bd3a4ab47e4e669540186844983915dd77457b59267fe7ead04711258c6e539c5fb09f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9bf6ef5848319ddcab7c75f94f11de5
SHA1 d5bdd658cad4137cd2cd296d8b2edb0ef5d06f41
SHA256 feeb8e7b728f5ca1dfa6312656ddaa0e0fc21a90604ea30bdccf5f1fdfb38250
SHA512 117dcf691ba66668a6832a5db8e01efe5fb87c39041fa262d0cbdd42366fe4d2ff304a61622e96decc2cce1c243e6a6fc231ac5a191e2fd0d80f23143d4ed7ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7ddb3fce3574d2dc558b0a967c1d416
SHA1 36c7ff462c22ae503b95c1d2b0db7f2612e5247f
SHA256 d386e325ef45246abb40d6c3db33a38bcf3212a23b915de31eb4f02946b2181f
SHA512 ca3339b981f311f787239cef4dd2041a3ed02ce6ab2fa35a3269b17cb1721688c57c8222eca1c44f11c81aff8cd26915fba0e1eb9275e618668a333bb77775a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1ff02cb39e9d334a79067a001a19206
SHA1 efe31f661a8bb053ff79093f1562740412016b17
SHA256 978f3ccfe61993a683c5b43302346f5ee75c349e3ec1ccf94c83977f09f30062
SHA512 cfe846757e5bb770d26ad153243b7624326e77cafab6a509b872411bb9a5fabe0f65c9395878d4a2fc07173bf1c11e2e28b2dd7cceba0ec873c1f63bc033ef1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c933fde09cd5c0ed3e69e11e682df53c
SHA1 45eef6cf1d9b6861c45d4f23f21cd640118de4d4
SHA256 cc268e228676510d160ed136d3a75bcd5e8408b240320913e590db9bdb0c9be6
SHA512 eb9d9a0b6728ca9fe5fbb86a887851743d6d90e50de3ee60efe42481d13e2fad76f978b640aace6dc5c19ec01736c3248ef639c66571763eacb3434f95cbd4f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 395e8b309ef14c385e72772750ac0927
SHA1 3de03535d2881d1d18ff362c5123811b05e6b9fd
SHA256 5064e02ff807fb85ed2fd2ccbe8a97f08e43aeb744be42fdcccaed13bb8c5060
SHA512 a62f88f5e07c9e7066788af859c8244066c7bc1b598dfd6c414ff1232aed0dbd592e145f6aa0a3cea554c81b3809b2c21a337cf80b30794506c88e2398142316

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9a57e5108ab891f6c022468a7d4b646
SHA1 15acdb096e79d154026e230f128a0b2af0c4fbb0
SHA256 cbfa57e21bc4b94a5e180672d7edd08474d147c0066cd5d48f807cdc17e5c3e1
SHA512 706a9b974419b37e43ff4ffe1bac7864996ca5e8d1078d659c8f5581f4e467e3c618af0721c083e08ce5b66422100ba85d58161a48b3b83487c28b8e3aa93c8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b43db6bc1357ebc6dad18b97a587c0a9
SHA1 85f64d7f4ec5498d55b16b2b170b80c98922fcc1
SHA256 480328a6df69c34a4c1293f8d8b5d3462ef715ca2f2623c970270aad01e67fac
SHA512 6bd62b491df94ca0c5c80f10a7a58e769d861dbb33463bf4bc7e05509883e28c22688de74629187dafb3c6f8f9f3498c3ee11bb41997400bccf6863ee82a86f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79ea1bd694ba2c0c4db8044b06f21ab3
SHA1 bef6880bbd22883b594b84b1a8367c678c6a7644
SHA256 66986644d492483a5fda80c52222989607f93d3ec86f01148635c0516c3cdcf6
SHA512 4a8c5995d121a6a09aac5e4945250f8b01ce4d70e6f19642b569be24556d107592b3e1e5ea4a20348b7b32397c79b499d07bc5a6250c1f18371e89c4d0ec4f24

memory/2188-498-0x0000000010000000-0x000000001004C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9d4a882cd60aa7ea7ded09a61885f87
SHA1 c716c527f3077752fef10d5f80a90787578ee89b
SHA256 4c9d03c8316535a4f5c0f75ddd82f17ee90a2dee9e40ced8b3a28389857bb53e
SHA512 6666386c5131cb543ec067ca61a6905221f75bd3e538c443b577d1131f35ebd421c79f1ddccbcc7327413a6619b4c8a23ff4feaa70ee874cdb3b74a004c40b54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 804a878e58ebd88695521cfb7c848956
SHA1 8a7c19dd18c599706e1fbe93aad3d1da2fad15fb
SHA256 acfc73186b8b1aecd0c43f9ae887464547502e53390876c7667995ac57a0fd69
SHA512 9daabff85a799e2302eae97fb2d84360505b0096baeb8301bed8333647eeade030cc76c087c7aba54f5cf8f36db4b0ad255247aa09d65e84121efb08242ddd94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8bd44c2a2ee4a0dc34c923b3196d1468
SHA1 9d74becb9a49bd7f1281fd8c439cef3d7be9bcdd
SHA256 f8b2decf22534341000d92070d0a4463debe9461881d6001a0f428166157fea2
SHA512 c88f9d76343b3db8bdfc7204a524d755b52f5e600b27a281916fb5da506f376d3af9177ba4400c4d8284ce2737192d3de54e91719efe0e732e5098fce5fd8e9d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 badb31e52d657e89fa69d390d5552769
SHA1 bd3efc181f6f502e301506d90e7dd6cffb6a7cb9
SHA256 db466af5d4755b3f1e4b695a7e771b7895fb8b01d6b0704a4b80bee1b928601f
SHA512 33fbcad536254fdf0a6c31f834bb8c303928679e2fb7bcd67f686bc4c8214742c8fdae5ee04335329601299267b92d327e22d544c5300a06bb2441c049433fdf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a49d487c25349ee8cea90e898668fee
SHA1 dec4593be95be951b7b8a540a55e619b8f62da01
SHA256 1e672dabed46a3d3a8f74460905efe70676d98e4581cc96160dbb6d90da62b3f
SHA512 2f1d74e50148690b9f94b1240b6e06130135d4976df15c6c5c8fe008cc00412be4b3aefb90a24d6105d49361c03de57a68104fce462e857023e154719139aa55

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 693ee82ecb33d11ae6fe718b714a1d50
SHA1 20d4bb004401959db9a02d3e345021948b83111d
SHA256 d0fa44808123978be6853b76cadce5edd6f32020fa3f9285285ab074f9ea64a2
SHA512 a4c3d2acadf48a56f246cc16b40bc03e4087e9db27ce780677602f56d930358b6cf57a5b581ab6a739822a5ec8db87718f14e01d58d15dd8784cc960f776a71f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2c69f013db0a75ba78ee0d668fe7c1b
SHA1 87da2c427a0298a0896931aa9a6d0f5552e8bc20
SHA256 b51b804727e056c0f3f0d6a4cba743b579d273b42b7b7934a35c35bcafd97714
SHA512 8a7a879150cb81615b72c786f545a61723e4b9701586c68984c208696a7323cd60d17989ad4eb92bdaae3cd9bfa51922fcc3b04be1065d9c8e286424d26794c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1c7a484fc1e77352d84176202cb8397
SHA1 674a4dc3f9a22bc75a8b12a959eb177f5c1c87d4
SHA256 c81c3317f6c7d72e24fdece86bcc315d618740e587155b885834a1a2d4e9cafd
SHA512 795437f17a7fc10a9367d9918746507b97af786b23e67c1423a25450d01790e421b122376348c0d78ad39eba740afd9be18c5db8fccf398cd8e1d85dfd078960

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 41f45066b1073df29f54001921c795c6
SHA1 be2ec39d81b2b83e11a1f9e54b0e052cbdd436b2
SHA256 a7ad82147ae2a754fe9a043af8441fcf505b735037e1928c2f5dec20b313924c
SHA512 f8488cbec35927798203fd316792f929e5675a38eaaf7345dfdd44f772db64301d775d6ebd07904e77039925c2f2bdf3933bb16cf7ba385865c2b3edd5a8d354

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9c8279495e201b02294fd3b2a867485
SHA1 f1da82efa1095be524f9372c6ede7a183a21293b
SHA256 8719d1cdcee5a19337137d806fd3bccede0af60033c48ca20bf255853a595883
SHA512 1ce73d339fb6e86bd65eec28ad3021b560e8edbbc4e9d6ff6c459ad58c84c7bee0009f3aba02d8a41616068859a41289b7025d119421a244159e62776bbf150f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win10v2004-20240611-en

Max time kernel

94s

Max time network

113s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\SkinH_EL.dll",#1

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32Srv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rundll32Srv.exe C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px3B44.tmp C:\Windows\SysWOW64\rundll32Srv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112806" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1135378714" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1131941547" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6F13464C-2A59-11EF-9D11-424A43B6706F} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112806" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425139882" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1131941547" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112806" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2348 wrote to memory of 5016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2348 wrote to memory of 5016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2348 wrote to memory of 5016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5016 wrote to memory of 1688 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 5016 wrote to memory of 1688 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 5016 wrote to memory of 1688 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 1688 wrote to memory of 4192 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1688 wrote to memory of 4192 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1688 wrote to memory of 4192 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 4192 wrote to memory of 4788 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 4192 wrote to memory of 4788 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 4788 wrote to memory of 3696 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4788 wrote to memory of 3696 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4788 wrote to memory of 3696 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\SkinH_EL.dll",#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\SkinH_EL.dll",#1

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4788 CREDAT:17410 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5016 -ip 5016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 652

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 api.bing.com udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 155.83.221.88.in-addr.arpa udp

Files

memory/5016-0-0x0000000010000000-0x000000001004C000-memory.dmp

C:\Windows\SysWOW64\rundll32Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/5016-6-0x0000000010000000-0x000000001004C000-memory.dmp

memory/5016-5-0x0000000010009000-0x000000001000A000-memory.dmp

memory/1688-4-0x0000000000400000-0x000000000042E000-memory.dmp

memory/5016-15-0x0000000010000000-0x000000001004C000-memory.dmp

memory/4192-17-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4192-16-0x00000000005A0000-0x00000000005AF000-memory.dmp

memory/1688-14-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4192-13-0x00000000005B0000-0x00000000005B1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-14 14:21

Reported

2024-06-14 14:24

Platform

win10v2004-20240611-en

Max time kernel

128s

Max time network

142s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\mb.dll",#1

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32Srv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rundll32Srv.exe C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px369B.tmp C:\Windows\SysWOW64\rundll32Srv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\rundll32Srv.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112806" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6F13357F-2A59-11EF-90FA-525B2696ACE5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425139882" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1133655713" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1139749787" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1133655713" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112806" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112806" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 380 wrote to memory of 1604 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 380 wrote to memory of 1604 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 380 wrote to memory of 1604 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1604 wrote to memory of 740 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 1604 wrote to memory of 740 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 1604 wrote to memory of 740 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32Srv.exe
PID 740 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 740 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 740 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2940 wrote to memory of 1784 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2940 wrote to memory of 1784 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1784 wrote to memory of 3024 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1784 wrote to memory of 3024 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1784 wrote to memory of 3024 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\mb.dll",#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows优化卫士 6.0\YiXinSafe\mb.dll",#1

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Windows\SysWOW64\rundll32Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:17410 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4432,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8

Network

Country Destination Domain Proto
US 13.107.42.16:443 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 api.bing.com udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 199.232.210.172:80 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Windows\SysWOW64\rundll32Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/740-12-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1604-7-0x0000000010000000-0x0000000010897000-memory.dmp

memory/2940-11-0x00000000004A0000-0x00000000004A1000-memory.dmp

memory/740-9-0x0000000002040000-0x000000000204F000-memory.dmp

memory/2940-15-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2940-13-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QZRYTBAT\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee