Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 09:02
Static task
static1
Behavioral task
behavioral1
Sample
YoudaoDict_fanyiweb_navigation.msi
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
YoudaoDict_fanyiweb_navigation.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
YoudaoDict_fanyiweb_navigation.msi
-
Size
136.4MB
-
MD5
5e0ae252dac3cd6f373b22196b777bef
-
SHA1
a8882dfe7c20d90182680a097a579eb8dbe68705
-
SHA256
89f508689ba3884477bd37d9bfa1ba5f6be1cb1f1d18f3d9bb56ff18d0c315ce
-
SHA512
657c8dff4e56007cd144ba9aba020bb58dcfbed62a76f24c5409f76f63a25f56ae2918fe3c2753008eac5be4b8b3742ecd1925b7ff6fe39cc3408409d3b52fb9
-
SSDEEP
3145728:VNflHHLhwYc7Hd2C5lI2I8OEq9NPjWa/3sn3CJGWn1tTx5cYw:VJlHH9wYKdz7I29OJzPNCCws1TC
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files\ProvideBrokerFearless\DiBpAPdZHEfb.xml ytVmWffRazCj.exe File created C:\Program Files\ProvideBrokerFearless\BtKrHWYQcg4.exe ytVmWffRazCj.exe File created C:\Program Files\ProvideBrokerFearless\DiBpAPdZHEfb.exe ytVmWffRazCj.exe File opened for modification C:\Program Files\ProvideBrokerFearless BtKrHWYQcg4.exe File created C:\Program Files\ProvideBrokerFearless\dyCPqIGaifpMGXHxudpD msiexec.exe File created C:\Program Files\ProvideBrokerFearless\MOELauncherSetup_V0TKW.exe msiexec.exe File created C:\Program Files\ProvideBrokerFearless\DiBpAPdZHEfb.xml ytVmWffRazCj.exe File opened for modification C:\Program Files\ProvideBrokerFearless\DiBpAPdZHEfb.exe ytVmWffRazCj.exe File created C:\Program Files\ProvideBrokerFearless\YoudaoDict_fanyiweb_navigation.exe msiexec.exe File created C:\Program Files\ProvideBrokerFearless\ytVmWffRazCj.exe msiexec.exe File opened for modification C:\Program Files\ProvideBrokerFearless\BtKrHWYQcg4.exe ytVmWffRazCj.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\f76ec63.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIED6B.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76ec62.msi msiexec.exe File opened for modification C:\Windows\Installer\f76ec62.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76ec65.msi msiexec.exe File opened for modification C:\Windows\Installer\f76ec63.ipi msiexec.exe -
Executes dropped EXE 3 IoCs
pid Process 552 ytVmWffRazCj.exe 1820 BtKrHWYQcg4.exe 2996 YoudaoDict_fanyiweb_navigation.exe -
Loads dropped DLL 13 IoCs
pid Process 264 MsiExec.exe 264 MsiExec.exe 264 MsiExec.exe 264 MsiExec.exe 264 MsiExec.exe 1820 BtKrHWYQcg4.exe 1820 BtKrHWYQcg4.exe 2996 YoudaoDict_fanyiweb_navigation.exe 2996 YoudaoDict_fanyiweb_navigation.exe 2996 YoudaoDict_fanyiweb_navigation.exe 2996 YoudaoDict_fanyiweb_navigation.exe 2996 YoudaoDict_fanyiweb_navigation.exe 2996 YoudaoDict_fanyiweb_navigation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1732 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ytVmWffRazCj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BtKrHWYQcg4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDict_fanyiweb_navigation.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 BtKrHWYQcg4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" BtKrHWYQcg4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E BtKrHWYQcg4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust" BtKrHWYQcg4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8A4DC99527F1CD243A9B6DAB2D54867A\3B391054DF16BBC4C9C629A988D0FA29 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\Version = "151060481" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\PackageCode = "825AD7E6D00B41F4092AF66CE4F50FC0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8A4DC99527F1CD243A9B6DAB2D54867A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList\PackageName = "YoudaoDict_fanyiweb_navigation.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3B391054DF16BBC4C9C629A988D0FA29\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3B391054DF16BBC4C9C629A988D0FA29 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3B391054DF16BBC4C9C629A988D0FA29\ProductName = "ProvideBrokerFearless" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2020 msiexec.exe 2020 msiexec.exe 1820 BtKrHWYQcg4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1732 msiexec.exe Token: SeIncreaseQuotaPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeSecurityPrivilege 2020 msiexec.exe Token: SeCreateTokenPrivilege 1732 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1732 msiexec.exe Token: SeLockMemoryPrivilege 1732 msiexec.exe Token: SeIncreaseQuotaPrivilege 1732 msiexec.exe Token: SeMachineAccountPrivilege 1732 msiexec.exe Token: SeTcbPrivilege 1732 msiexec.exe Token: SeSecurityPrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeLoadDriverPrivilege 1732 msiexec.exe Token: SeSystemProfilePrivilege 1732 msiexec.exe Token: SeSystemtimePrivilege 1732 msiexec.exe Token: SeProfSingleProcessPrivilege 1732 msiexec.exe Token: SeIncBasePriorityPrivilege 1732 msiexec.exe Token: SeCreatePagefilePrivilege 1732 msiexec.exe Token: SeCreatePermanentPrivilege 1732 msiexec.exe Token: SeBackupPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeShutdownPrivilege 1732 msiexec.exe Token: SeDebugPrivilege 1732 msiexec.exe Token: SeAuditPrivilege 1732 msiexec.exe Token: SeSystemEnvironmentPrivilege 1732 msiexec.exe Token: SeChangeNotifyPrivilege 1732 msiexec.exe Token: SeRemoteShutdownPrivilege 1732 msiexec.exe Token: SeUndockPrivilege 1732 msiexec.exe Token: SeSyncAgentPrivilege 1732 msiexec.exe Token: SeEnableDelegationPrivilege 1732 msiexec.exe Token: SeManageVolumePrivilege 1732 msiexec.exe Token: SeImpersonatePrivilege 1732 msiexec.exe Token: SeCreateGlobalPrivilege 1732 msiexec.exe Token: SeBackupPrivilege 2464 vssvc.exe Token: SeRestorePrivilege 2464 vssvc.exe Token: SeAuditPrivilege 2464 vssvc.exe Token: SeBackupPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeLoadDriverPrivilege 2900 DrvInst.exe Token: SeLoadDriverPrivilege 2900 DrvInst.exe Token: SeLoadDriverPrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe Token: SeTakeOwnershipPrivilege 2020 msiexec.exe Token: SeRestorePrivilege 2020 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1732 msiexec.exe 1732 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 2020 wrote to memory of 264 2020 msiexec.exe 35 PID 264 wrote to memory of 552 264 MsiExec.exe 36 PID 264 wrote to memory of 552 264 MsiExec.exe 36 PID 264 wrote to memory of 552 264 MsiExec.exe 36 PID 264 wrote to memory of 552 264 MsiExec.exe 36 PID 264 wrote to memory of 1820 264 MsiExec.exe 38 PID 264 wrote to memory of 1820 264 MsiExec.exe 38 PID 264 wrote to memory of 1820 264 MsiExec.exe 38 PID 264 wrote to memory of 1820 264 MsiExec.exe 38 PID 264 wrote to memory of 2996 264 MsiExec.exe 39 PID 264 wrote to memory of 2996 264 MsiExec.exe 39 PID 264 wrote to memory of 2996 264 MsiExec.exe 39 PID 264 wrote to memory of 2996 264 MsiExec.exe 39 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1732
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DCC05386E903A71A29F5C4DB181524C1 M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Program Files\ProvideBrokerFearless\ytVmWffRazCj.exe"C:\Program Files\ProvideBrokerFearless\ytVmWffRazCj.exe" x "C:\Program Files\ProvideBrokerFearless\dyCPqIGaifpMGXHxudpD" -o"C:\Program Files\ProvideBrokerFearless\" -pjgNXmLXevyMZUbQgvJBp -y3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552
-
-
C:\Program Files\ProvideBrokerFearless\BtKrHWYQcg4.exe"C:\Program Files\ProvideBrokerFearless\BtKrHWYQcg4.exe" -number 206 -file file3 -mode mode3 -flag flag33⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
C:\Program Files\ProvideBrokerFearless\YoudaoDict_fanyiweb_navigation.exe"C:\Program Files\ProvideBrokerFearless\YoudaoDict_fanyiweb_navigation.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2996
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C0" "0000000000000240"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD589c70ea99ed61a328938bf7655b2a18a
SHA1d747c9cde0e57caf7835c0bbe53392236e1e43e9
SHA256edb114cd82aebecbe9e07188a47135a51b3c3b235c2bcb91f63376149825615c
SHA5127fa44c7b84331b0428bef0b749dc70e27a26c553ea28907855b1b73b2e0904e1b1deb094b6f578f2b12dc3347edf9558f5e95dab460c0ab0d436ed6d1349b24a
-
Filesize
3.2MB
MD57d9f488ced67ada533312513fc6dbd6a
SHA1b1d4aa4613fd48274dd6808e200ab7d08e21c57e
SHA2563b98e68f11d11b2746e56bf4eb72a8c467574635e1a6c0f4d5142606288a2fb6
SHA5128410fef50eca91445d34e83a52fef2111577b0c167fe5fe80a449311a3154acc5a4c479595f3a092c4cbfb0cd6901b1ba817aa5cbab3bb3a23c80b4ddf676403
-
Filesize
1.9MB
MD5360b21de100afb1b2c3c842bc697752a
SHA1735cfd5645d93b075cf6982573712fe174d479a2
SHA256d7601627796be81e71decfe9ab4f51d9c28af123b66aba3c59386c822ea2cad1
SHA5121232dd9fbce27aded3053ebb12b0d2007626a167de5d113bda502d40c22102d432cd3c4fea5f754de8a8d2bff530adc0536adc84fe40a32bd72859df954337d7
-
Filesize
574KB
MD542badc1d2f03a8b1e4875740d3d49336
SHA1cee178da1fb05f99af7a3547093122893bd1eb46
SHA256c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA5126bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
-
Filesize
48KB
MD5765cf74fc709fb3450fa71aac44e7f53
SHA1b423271b4faac68f88fef15fa4697cf0149bad85
SHA256cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA5120c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6
-
Filesize
38KB
MD5dab018047c171165c18329d5c59b617e
SHA188848ac4aceb7358f13d225de6d4fd0a5696517a
SHA2561cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA5121f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d
-
Filesize
38KB
MD55f7b90c87ea0517771862fae5f11ce94
SHA1fc9f195e888d960139278c04a0e78996c6442d5b
SHA256f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0
-
Filesize
3KB
MD55754c67775c3f4f50a4780b3bca026b1
SHA13e95c72c13d6175ef275280fe270d678acee46e9
SHA2562a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f
-
Filesize
908KB
MD56d20c27bc3168af9c076b459f1da05dc
SHA1d49795bc5ec392f5da3a65958bc8bd2dbaaddcfe
SHA256da8894cbad7c440ad992416421611071d9b82cda3a3c8287f7c1d75c0386f468
SHA512e4233a72e59bd1f7ee0dc4559ef06b360025e52414c2d6f4ee317e5c193109c1e4be70fc89e74e4a6061035c7e18b97e61ab96716b4ab0ab997b178bcef9d7bb
-
Filesize
832KB
MD5d305d506c0095df8af223ac7d91ca327
SHA1679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
SHA256923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
SHA51294d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796
-
Filesize
95KB
MD55a94bf8916a11b5fe94aca44886c9393
SHA1820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA2560b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA51279cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
