Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
YoudaoDict.msi
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
YoudaoDict.msi
Resource
win10v2004-20240910-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
YoudaoDict.msi
-
Size
118.9MB
-
MD5
08af6212250f9ee918dc85d224e0b195
-
SHA1
ff8b703e8d852e02c944151231a929056303cc6d
-
SHA256
2bd768ae300b639e34d88004ee46d4d351727d88108a33fb3cd9c0fc96f07e04
-
SHA512
6adcc075ad6719fea7fe1fe67f3ad5c251f5b90bfc88fa045bd45cb6192e8bb3ae339217b58792b03c2f54806313b3dc6c8b47bc2c14e714fa0f185bc3e5649b
-
SSDEEP
3145728:v9A77B6rdyb3Z38ivnfYN2mDU0KfhZSr5:87MrYTZfe2mFKJY
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1988-37-0x000000002BDA0000-0x000000002BF5A000-memory.dmp purplefox_rootkit behavioral2/memory/1988-39-0x000000002BDA0000-0x000000002BF5A000-memory.dmp purplefox_rootkit behavioral2/memory/1988-140-0x000000002BDA0000-0x000000002BF5A000-memory.dmp purplefox_rootkit behavioral2/memory/1988-142-0x000000002BDA0000-0x000000002BF5A000-memory.dmp purplefox_rootkit behavioral2/memory/1988-144-0x000000002BDA0000-0x000000002BF5A000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral2/memory/1988-37-0x000000002BDA0000-0x000000002BF5A000-memory.dmp family_gh0strat behavioral2/memory/1988-39-0x000000002BDA0000-0x000000002BF5A000-memory.dmp family_gh0strat behavioral2/memory/1988-140-0x000000002BDA0000-0x000000002BF5A000-memory.dmp family_gh0strat behavioral2/memory/1988-142-0x000000002BDA0000-0x000000002BF5A000-memory.dmp family_gh0strat behavioral2/memory/1988-144-0x000000002BDA0000-0x000000002BF5A000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: HBqWcVOzxI29.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: HBqWcVOzxI29.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: HBqWcVOzxI29.exe File opened (read-only) \??\R: HBqWcVOzxI29.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: HBqWcVOzxI29.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: HBqWcVOzxI29.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: HBqWcVOzxI29.exe File opened (read-only) \??\Q: HBqWcVOzxI29.exe File opened (read-only) \??\T: HBqWcVOzxI29.exe File opened (read-only) \??\G: HBqWcVOzxI29.exe File opened (read-only) \??\N: HBqWcVOzxI29.exe File opened (read-only) \??\W: HBqWcVOzxI29.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: HBqWcVOzxI29.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: HBqWcVOzxI29.exe File opened (read-only) \??\V: HBqWcVOzxI29.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: HBqWcVOzxI29.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: HBqWcVOzxI29.exe File opened (read-only) \??\K: HBqWcVOzxI29.exe File opened (read-only) \??\O: HBqWcVOzxI29.exe File opened (read-only) \??\J: HBqWcVOzxI29.exe File opened (read-only) \??\S: HBqWcVOzxI29.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files\AlignAdvocateBrave HBqWcVOzxI29.exe File created C:\Program Files\AlignAdvocateBrave\CfqbqwlsBkImozhluiNB msiexec.exe File created C:\Program Files\AlignAdvocateBrave\SdGMZBnVcZya.exe msiexec.exe File created C:\Program Files\AlignAdvocateBrave\UnityPlayer.dll msiexec.exe File created C:\Program Files\AlignAdvocateBrave\YoudaoDict_fanyiweb_navigation.exe msiexec.exe File created C:\Program Files\AlignAdvocateBrave\HBqWcVOzxI29.exe SdGMZBnVcZya.exe File opened for modification C:\Program Files\AlignAdvocateBrave\HBqWcVOzxI29.exe SdGMZBnVcZya.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSID2E0.tmp msiexec.exe File created C:\Windows\Installer\e57d042.msi msiexec.exe File created C:\Windows\Installer\e57d040.msi msiexec.exe File opened for modification C:\Windows\Installer\e57d040.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4F5801A5-A195-49AE-8EA9-1AF6E13D3F70} msiexec.exe -
Executes dropped EXE 4 IoCs
pid Process 2488 SdGMZBnVcZya.exe 3664 HBqWcVOzxI29.exe 2844 YoudaoDict_fanyiweb_navigation.exe 1988 HBqWcVOzxI29.exe -
Loads dropped DLL 6 IoCs
pid Process 2844 YoudaoDict_fanyiweb_navigation.exe 2844 YoudaoDict_fanyiweb_navigation.exe 2844 YoudaoDict_fanyiweb_navigation.exe 2844 YoudaoDict_fanyiweb_navigation.exe 2844 YoudaoDict_fanyiweb_navigation.exe 2844 YoudaoDict_fanyiweb_navigation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4944 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SdGMZBnVcZya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBqWcVOzxI29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDict_fanyiweb_navigation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBqWcVOzxI29.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005d98d1691ddd1b040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005d98d1690000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005d98d169000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5d98d169000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005d98d16900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HBqWcVOzxI29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz HBqWcVOzxI29.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E7B405A20E3AE3D46BC1AE01951AE8AF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList\PackageName = "YoudaoDict.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A1085F4591AEA94E89AA16F1ED3F307 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\ProductName = "AlignAdvocateBrave" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\PackageCode = "7F151551F32F4394CAE575988B4846EA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\Version = "134545408" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E7B405A20E3AE3D46BC1AE01951AE8AF\5A1085F4591AEA94E89AA16F1ED3F307 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A1085F4591AEA94E89AA16F1ED3F307\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A1085F4591AEA94E89AA16F1ED3F307\ProductFeature msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3624 msiexec.exe 3624 msiexec.exe 3664 HBqWcVOzxI29.exe 3664 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe 1988 HBqWcVOzxI29.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4944 msiexec.exe Token: SeIncreaseQuotaPrivilege 4944 msiexec.exe Token: SeSecurityPrivilege 3624 msiexec.exe Token: SeCreateTokenPrivilege 4944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4944 msiexec.exe Token: SeLockMemoryPrivilege 4944 msiexec.exe Token: SeIncreaseQuotaPrivilege 4944 msiexec.exe Token: SeMachineAccountPrivilege 4944 msiexec.exe Token: SeTcbPrivilege 4944 msiexec.exe Token: SeSecurityPrivilege 4944 msiexec.exe Token: SeTakeOwnershipPrivilege 4944 msiexec.exe Token: SeLoadDriverPrivilege 4944 msiexec.exe Token: SeSystemProfilePrivilege 4944 msiexec.exe Token: SeSystemtimePrivilege 4944 msiexec.exe Token: SeProfSingleProcessPrivilege 4944 msiexec.exe Token: SeIncBasePriorityPrivilege 4944 msiexec.exe Token: SeCreatePagefilePrivilege 4944 msiexec.exe Token: SeCreatePermanentPrivilege 4944 msiexec.exe Token: SeBackupPrivilege 4944 msiexec.exe Token: SeRestorePrivilege 4944 msiexec.exe Token: SeShutdownPrivilege 4944 msiexec.exe Token: SeDebugPrivilege 4944 msiexec.exe Token: SeAuditPrivilege 4944 msiexec.exe Token: SeSystemEnvironmentPrivilege 4944 msiexec.exe Token: SeChangeNotifyPrivilege 4944 msiexec.exe Token: SeRemoteShutdownPrivilege 4944 msiexec.exe Token: SeUndockPrivilege 4944 msiexec.exe Token: SeSyncAgentPrivilege 4944 msiexec.exe Token: SeEnableDelegationPrivilege 4944 msiexec.exe Token: SeManageVolumePrivilege 4944 msiexec.exe Token: SeImpersonatePrivilege 4944 msiexec.exe Token: SeCreateGlobalPrivilege 4944 msiexec.exe Token: SeBackupPrivilege 464 vssvc.exe Token: SeRestorePrivilege 464 vssvc.exe Token: SeAuditPrivilege 464 vssvc.exe Token: SeBackupPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeDebugPrivilege 3664 HBqWcVOzxI29.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe Token: SeRestorePrivilege 3624 msiexec.exe Token: SeTakeOwnershipPrivilege 3624 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4944 msiexec.exe 4944 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3624 wrote to memory of 4672 3624 msiexec.exe 91 PID 3624 wrote to memory of 4672 3624 msiexec.exe 91 PID 3624 wrote to memory of 2992 3624 msiexec.exe 93 PID 3624 wrote to memory of 2992 3624 msiexec.exe 93 PID 3624 wrote to memory of 2992 3624 msiexec.exe 93 PID 2992 wrote to memory of 2488 2992 MsiExec.exe 94 PID 2992 wrote to memory of 2488 2992 MsiExec.exe 94 PID 2992 wrote to memory of 2488 2992 MsiExec.exe 94 PID 2992 wrote to memory of 3664 2992 MsiExec.exe 96 PID 2992 wrote to memory of 3664 2992 MsiExec.exe 96 PID 2992 wrote to memory of 3664 2992 MsiExec.exe 96 PID 2992 wrote to memory of 2844 2992 MsiExec.exe 97 PID 2992 wrote to memory of 2844 2992 MsiExec.exe 97 PID 2992 wrote to memory of 2844 2992 MsiExec.exe 97 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\YoudaoDict.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4672
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 248F903BEBA5A7AACE21B8A563B76836 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files\AlignAdvocateBrave\SdGMZBnVcZya.exe"C:\Program Files\AlignAdvocateBrave\SdGMZBnVcZya.exe" x "C:\Program Files\AlignAdvocateBrave\CfqbqwlsBkImozhluiNB" -o"C:\Program Files\AlignAdvocateBrave\" -pqPUSdBCyjymGowjaYcmw -y3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488
-
-
C:\Program Files\AlignAdvocateBrave\HBqWcVOzxI29.exe"C:\Program Files\AlignAdvocateBrave\HBqWcVOzxI29.exe" -number 199 -file file3 -mode mode3 -flag flag33⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
-
C:\Program Files\AlignAdvocateBrave\YoudaoDict_fanyiweb_navigation.exe"C:\Program Files\AlignAdvocateBrave\YoudaoDict_fanyiweb_navigation.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2844
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Program Files\AlignAdvocateBrave\HBqWcVOzxI29.exe"C:\Program Files\AlignAdvocateBrave\HBqWcVOzxI29.exe" -file file3 -mode mode3 -flag flag3 -number 2001⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD524b35411688ce8ba276846daec84c222
SHA129083199cbf67bb1e53a581f35769142101a7256
SHA2567d9be4f4369f75a3900ea79bf8fecdc0e10644fc4af37aec17aac87e47d71c11
SHA5128fee3d24d5d54380d9c975d16b934401f4e723dd7b5e9c7346c8abccfa0262a733113d42408781bf366f8177dcc7d501417f31f1d53cf4466fac3d1c47825b1b
-
Filesize
731KB
MD5586bd04dc1752714c4d67037ebcc238e
SHA174f816994933a302aa7eaa4844ceedc43aeaee80
SHA256f00bf5f78c82a847e8dbdef725498f67611f33b1e5e1ba3987dfa8c5e04e5e8e
SHA51257321a54aabcfae2a2e397b6401e421fad1fafd5b8e087f0c4583103fa13b277a267be24b20f046467f76f735baff13453ac811d77336aafb7fbc4f87be842fa
-
Filesize
2.0MB
MD5d2c6c4a00a06a831336e914339ff38e9
SHA16ab2c58fb5c6a088ef50e1e1ebd49e86863e00f4
SHA25628b09c1ab78d474a451017d23f7c5c8b8a18b5545a9c7aa9bc06bef014965ea8
SHA512bd2b5d6c7fc103cc5bdd29757a0295338d3401107290cdad52c562d767a2429e6f73be5923f19213a24feadcb5bbd6ee73b0ac1d1eec8354affdfc9b60597183
-
Filesize
574KB
MD542badc1d2f03a8b1e4875740d3d49336
SHA1cee178da1fb05f99af7a3547093122893bd1eb46
SHA256c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA5126bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
-
Filesize
95KB
MD55a94bf8916a11b5fe94aca44886c9393
SHA1820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA2560b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA51279cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20
-
Filesize
48KB
MD5765cf74fc709fb3450fa71aac44e7f53
SHA1b423271b4faac68f88fef15fa4697cf0149bad85
SHA256cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA5120c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
38KB
MD5dab018047c171165c18329d5c59b617e
SHA188848ac4aceb7358f13d225de6d4fd0a5696517a
SHA2561cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA5121f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d
-
Filesize
38KB
MD55f7b90c87ea0517771862fae5f11ce94
SHA1fc9f195e888d960139278c04a0e78996c6442d5b
SHA256f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0
-
Filesize
3KB
MD55754c67775c3f4f50a4780b3bca026b1
SHA13e95c72c13d6175ef275280fe270d678acee46e9
SHA2562a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
908KB
MD56d20c27bc3168af9c076b459f1da05dc
SHA1d49795bc5ec392f5da3a65958bc8bd2dbaaddcfe
SHA256da8894cbad7c440ad992416421611071d9b82cda3a3c8287f7c1d75c0386f468
SHA512e4233a72e59bd1f7ee0dc4559ef06b360025e52414c2d6f4ee317e5c193109c1e4be70fc89e74e4a6061035c7e18b97e61ab96716b4ab0ab997b178bcef9d7bb
-
Filesize
24.1MB
MD5f98ef578b2f12fdd2f1e7c502cf8e18a
SHA1a9bdced81988fbb6582a4b494c81326af9667c60
SHA256b0974e1edf38af3a25f89fd45e71d0d3aff8da219addd4d0707e30af51fdb47f
SHA512dd8135516be87008e421be0138ee6da3266b762ae999e06f1f8d517f4dc159bc3e5087e9e5c5fa212c36da1baca353831bc22da9d4343e8f2a5937da3c0951b0
-
\??\Volume{69d1985d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e60c607b-ae8b-4b5b-bd05-e2930826a5fc}_OnDiskSnapshotProp
Filesize6KB
MD58a0cbdf5ade9e94ea4f1a2ce76a7feef
SHA1d0613e8dfab2ef871113c9721698b62122bbda0f
SHA256844e4c355bd7537715a4267755ef2990c99b86d90ad323211cea6e746dbb2234
SHA5123feb91b1c933cc0b2703cb64ef2c8bba87a0299e7418da84ddb224cf61b48d5375e3ce30891f67667f9ea061ec839baf1d34ff039efc0af698176efb98d077e6
