2c612c1987f1932d71b725d7294fd5d81aba0476ec0948812a54ff0a9db4c53c

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YoudaoDict_fanyiweb_navigation.msi
Size

114.3MB
MD5

8634adb0215e3a90751fb0cbca90becd
SHA1

4d3cd1399e78730ebcb46bd0d6a6ad6a5dc1e620
SHA256

2c612c1987f1932d71b725d7294fd5d81aba0476ec0948812a54ff0a9db4c53c
SHA512

4e9d823e71a7be6251aac61c67641acd8a2c14fb227de9a45c7cf3d6a7cc9289e13457dbfe2c79ac8c8dd78e84f4798e98f484c5b4329f1c06424119fa375dcd
SSDEEP

3145728:UYP/W8g21cAIPkqjyInzEmbMUo0B2TPZVxLR:U+HgOcPsq/VMjg2NN

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.xml	vsIUYhBxXQGE.exe
File created	C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe	vsIUYhBxXQGE.exe
File opened for modification	C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe	vsIUYhBxXQGE.exe
File opened for modification	C:\Program Files\ExpandConnectorHappy	ekWKvevMHU4.exe
File created	C:\Program Files\ExpandConnectorHappy\MfwQXuOCukyLkKcAGzRa	msiexec.exe
File created	C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe	msiexec.exe
File created	C:\Program Files\ExpandConnectorHappy\YoudaoDict_fanyiweb_navigation.exe	msiexec.exe
File created	C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe	vsIUYhBxXQGE.exe
File created	C:\Program Files\ExpandConnectorHappy\node.dll	msiexec.exe
File created	C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.xml	vsIUYhBxXQGE.exe
File opened for modification	C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe	vsIUYhBxXQGE.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f76e7b0.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76e7b0.msi	msiexec.exe
File created	C:\Windows\Installer\f76e7b1.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8F8.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e7b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e7b1.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
1476	vsIUYhBxXQGE.exe
2224	ekWKvevMHU4.exe
1388	YoudaoDict_fanyiweb_navigation.exe

Loads dropped DLL 8 IoCs

pid	Process
2224	ekWKvevMHU4.exe
2224	ekWKvevMHU4.exe
1388	YoudaoDict_fanyiweb_navigation.exe
1388	YoudaoDict_fanyiweb_navigation.exe
1388	YoudaoDict_fanyiweb_navigation.exe
1388	YoudaoDict_fanyiweb_navigation.exe
1388	YoudaoDict_fanyiweb_navigation.exe
1388	YoudaoDict_fanyiweb_navigation.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3060	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsIUYhBxXQGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDict_fanyiweb_navigation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ekWKvevMHU4.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\74B3339D2D2FE5E48824AF009A676FF8\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\Version = "50593795"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A6C868ECB8AC492488BE0F0440837C4B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\PackageCode = "4AC3A2656E5684D44B5A4DE675AC5AD3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList\PackageName = "YoudaoDict_fanyiweb_navigation.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\74B3339D2D2FE5E48824AF009A676FF8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A6C868ECB8AC492488BE0F0440837C4B\74B3339D2D2FE5E48824AF009A676FF8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\ProductName = "ExpandConnectorHappy"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74B3339D2D2FE5E48824AF009A676FF8\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
624	msiexec.exe
624	msiexec.exe
2224	ekWKvevMHU4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeSecurityPrivilege	624	msiexec.exe
Token: SeCreateTokenPrivilege	3060	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3060	msiexec.exe
Token: SeLockMemoryPrivilege	3060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3060	msiexec.exe
Token: SeMachineAccountPrivilege	3060	msiexec.exe
Token: SeTcbPrivilege	3060	msiexec.exe
Token: SeSecurityPrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeLoadDriverPrivilege	3060	msiexec.exe
Token: SeSystemProfilePrivilege	3060	msiexec.exe
Token: SeSystemtimePrivilege	3060	msiexec.exe
Token: SeProfSingleProcessPrivilege	3060	msiexec.exe
Token: SeIncBasePriorityPrivilege	3060	msiexec.exe
Token: SeCreatePagefilePrivilege	3060	msiexec.exe
Token: SeCreatePermanentPrivilege	3060	msiexec.exe
Token: SeBackupPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeShutdownPrivilege	3060	msiexec.exe
Token: SeDebugPrivilege	3060	msiexec.exe
Token: SeAuditPrivilege	3060	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3060	msiexec.exe
Token: SeChangeNotifyPrivilege	3060	msiexec.exe
Token: SeRemoteShutdownPrivilege	3060	msiexec.exe
Token: SeUndockPrivilege	3060	msiexec.exe
Token: SeSyncAgentPrivilege	3060	msiexec.exe
Token: SeEnableDelegationPrivilege	3060	msiexec.exe
Token: SeManageVolumePrivilege	3060	msiexec.exe
Token: SeImpersonatePrivilege	3060	msiexec.exe
Token: SeCreateGlobalPrivilege	3060	msiexec.exe
Token: SeBackupPrivilege	1088	vssvc.exe
Token: SeRestorePrivilege	1088	vssvc.exe
Token: SeAuditPrivilege	1088	vssvc.exe
Token: SeBackupPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	1244	DrvInst.exe
Token: SeLoadDriverPrivilege	1244	DrvInst.exe
Token: SeLoadDriverPrivilege	1244	DrvInst.exe
Token: SeLoadDriverPrivilege	1244	DrvInst.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3060	msiexec.exe
3060	msiexec.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1540	624	msiexec.exe	35
PID 624 wrote to memory of 1540	624	msiexec.exe	35
PID 624 wrote to memory of 1540	624	msiexec.exe	35
PID 624 wrote to memory of 1540	624	msiexec.exe	35
PID 624 wrote to memory of 1540	624	msiexec.exe	35
PID 1540 wrote to memory of 1476	1540	MsiExec.exe	36
PID 1540 wrote to memory of 1476	1540	MsiExec.exe	36
PID 1540 wrote to memory of 1476	1540	MsiExec.exe	36
PID 1540 wrote to memory of 1476	1540	MsiExec.exe	36
PID 1540 wrote to memory of 2224	1540	MsiExec.exe	38
PID 1540 wrote to memory of 2224	1540	MsiExec.exe	38
PID 1540 wrote to memory of 2224	1540	MsiExec.exe	38
PID 1540 wrote to memory of 2224	1540	MsiExec.exe	38
PID 1540 wrote to memory of 1388	1540	MsiExec.exe	39
PID 1540 wrote to memory of 1388	1540	MsiExec.exe	39
PID 1540 wrote to memory of 1388	1540	MsiExec.exe	39
PID 1540 wrote to memory of 1388	1540	MsiExec.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding A3DF15A1CFC0F346D0200ED70FDBADCE M Global\MSI0000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe
    "C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe" x "C:\Program Files\ExpandConnectorHappy\MfwQXuOCukyLkKcAGzRa" -o"C:\Program Files\ExpandConnectorHappy\" -pmGBkxYsXraIZsNILlsWU -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe
    "C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe" -number 150 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2224
- - C:\Program Files\ExpandConnectorHappy\YoudaoDict_fanyiweb_navigation.exe
    "C:\Program Files\ExpandConnectorHappy\YoudaoDict_fanyiweb_navigation.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D0" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76e7b2.rbs

Filesize
7KB

MD5
8190182fd1da619e1746c949a532edd8

SHA1
a4105417e9bfe644d89937bbec13cff004f32cdd

SHA256
a7a7bc2bbc686340fc3b31fe17ea3e7ec04d62cb123dec57e0e6583c0355a28a

SHA512
d1bac49bb1cc0e9eb5c4b57589e74080aa304a2cae2324734c4f538e2af221ef68299d0d3a8756916ade68653e876220ad6427b726c3f6927edfe12be41cbfa4

Download Submit
C:\Program Files\ExpandConnectorHappy\MfwQXuOCukyLkKcAGzRa

Filesize
1.9MB

MD5
06fd2e4e815c5f57748835bace0a2b41

SHA1
049e1690422249659e7b4e0ee9e118ad5db9e080

SHA256
ed089d47b597d2cf4a712a0d3545dcd17a7ec52955525d9c337c6aa5a032ee40

SHA512
343d7ce78f325bb5876e278a06cfb122cb14b6e46b2a6f0de7a874fa8fea9fa743e0447f6ceae6922ed8c5116248bde0129f53a7549a944599311a049b7806ff

Download Submit
C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe

Filesize
3.2MB

MD5
e8aac7ae25fadc0cdac93ea19c6b4aeb

SHA1
1c78766f43e23add4768dfffe2624510ce71d50d

SHA256
2dfaf798d43d3f7a873a3127678465d7b6fca11f68b6aa01c6ef34a7bfcdfaa9

SHA512
2fe1ec405cd8a4a2bb0326d715f7a14134876e18e879f48129fd9751852c2866400cb5b0b6406b78648072e49cf00a73eeb3aba5849f2fab23d4443b292d8f91

Download Submit
C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\OP_WndProc.dll

Filesize
48KB

MD5
765cf74fc709fb3450fa71aac44e7f53

SHA1
b423271b4faac68f88fef15fa4697cf0149bad85

SHA256
cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e

SHA512
0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\btn_agree.bmp

Filesize
38KB

MD5
dab018047c171165c18329d5c59b617e

SHA1
88848ac4aceb7358f13d225de6d4fd0a5696517a

SHA256
1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734

SHA512
1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\btn_disagree.bmp

Filesize
38KB

MD5
5f7b90c87ea0517771862fae5f11ce94

SHA1
fc9f195e888d960139278c04a0e78996c6442d5b

SHA256
f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2

SHA512
dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\checkbox_null.bmp

Filesize
3KB

MD5
5754c67775c3f4f50a4780b3bca026b1

SHA1
3e95c72c13d6175ef275280fe270d678acee46e9

SHA256
2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739

SHA512
df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\slide8.bmp

Filesize
908KB

MD5
6d20c27bc3168af9c076b459f1da05dc

SHA1
d49795bc5ec392f5da3a65958bc8bd2dbaaddcfe

SHA256
da8894cbad7c440ad992416421611071d9b82cda3a3c8287f7c1d75c0386f468

SHA512
e4233a72e59bd1f7ee0dc4559ef06b360025e52414c2d6f4ee317e5c193109c1e4be70fc89e74e4a6061035c7e18b97e61ab96716b4ab0ab997b178bcef9d7bb

Download Submit
\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\LockedList.dll

Filesize
95KB

MD5
5a94bf8916a11b5fe94aca44886c9393

SHA1
820d9c5e3365e323d6f43d3cce26fd9d2ea48b93

SHA256
0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d

SHA512
79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\SkinBtn.dll

Filesize
4KB

MD5
29818862640ac659ce520c9c64e63e9e

SHA1
485e1e6cc552fa4f05fb767043b1e7c9eb80be64

SHA256
e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb

SHA512
ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF3A4.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
memory/1540-12-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2224-28-0x000000000A730000-0x000000000A757000-memory.dmp

Filesize
156KB

Download