gh0strat | 39ae2756ab3ab2d86533344ddf0fc1e7fc14b8d271bb9321bbbf38909013173c

pid	Process
9260	YoudaoDictHelper.exe
10316	YoudaoDictHelper.exe
10456	YoudaoDictHelper.exe
4100	YoudaoDictHelper.exe
5584	YoudaoDictHelper.exe
4088	YoudaoDictHelper.exe
9188	YoudaoDictHelper.exe
1244	YoudaoDictHelper.exe
896	YoudaoDictHelper.exe
1364	YoudaoDictHelper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\YoudaoDict = "\"C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\YoudaoDict.exe\" -hide -autostart"	YoudaoDictInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\YoudaoDict = "\"C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\YoudaoDict.exe\" -hide -autostart"	YoudaoDict_fanyiweb_navigation.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	Phxph.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	Phxph.exe
File opened (read-only)	\??\X:	Phxph.exe
File opened (read-only)	\??\S:	Phxph.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	Phxph.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	Phxph.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	Phxph.exe
File opened (read-only)	\??\O:	Phxph.exe
File opened (read-only)	\??\M:	Phxph.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	Phxph.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	Phxph.exe
File opened (read-only)	\??\U:	Phxph.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	Phxph.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	Phxph.exe
File opened (read-only)	\??\T:	Phxph.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	Phxph.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	Phxph.exe
File opened (read-only)	\??\Y:	Phxph.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	Phxph.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	Phxph.exe
File opened (read-only)	\??\V:	Phxph.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDict.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Phxph.exe	SoftUpdate.exe
File opened for modification	C:\Windows\SysWOW64\Phxph.exe	SoftUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

pid	Process
2216	SoftUpdate.exe
2216	SoftUpdate.exe
2216	SoftUpdate.exe
2216	SoftUpdate.exe
2560	Phxph.exe
2560	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\YodaoDict.api	YoudaoDictInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\YodaoDict.api	YoudaoDictInstaller.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8612.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76840e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84F8.tmp	msiexec.exe
File created	C:\Windows\Installer\f768411.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AE6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768411.ipi	msiexec.exe
File created	C:\Windows\Installer\f76840e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86BF.tmp	msiexec.exe

Executes dropped EXE 35 IoCs

pid	Process
1888	MSI8AE6.tmp
2588	MSI8B27.tmp
1584	YoudaoDict_fanyiweb_navigation.exe
2216	SoftUpdate.exe
2560	Phxph.exe
2792	Phxph.exe
12684	YoudaoDictInstaller.exe
13308	YoudaoDictInstaller.exe
3196	InstallHelper.exe
2672	InstallHelper.exe
2336	InstallHelper.exe
5032	InstallHelper.exe
2344	InstallHelper.exe
2488	YoudaoDictInstaller.exe
7336	YoudaoDictInstaller.exe
7392	YoudaoDictInstaller.exe
7488	YoudaoDictIcon.exe
7568	YoudaoDictInstaller.exe
10220	YoudaoDict.exe
5780	YoudaoDictHelper.exe
3972	YoudaoDictHelper.exe
4100	YoudaoDictHelper.exe
4044	YoudaoDictHelper.exe
5584	YoudaoDictHelper.exe
4088	YoudaoDictHelper.exe
5424	YoudaoDictHelper.exe
9260	YoudaoDictHelper.exe
9188	YoudaoDictHelper.exe
10356	YoudaoWSH.exe
10400	YoudaoEDIT.exe
1244	YoudaoDictHelper.exe
10316	YoudaoDictHelper.exe
10456	YoudaoDictHelper.exe
896	YoudaoDictHelper.exe
1364	YoudaoDictHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2216	SoftUpdate.exe
2216	SoftUpdate.exe
2216	SoftUpdate.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
2488	YoudaoDictInstaller.exe
2488	YoudaoDictInstaller.exe
4340	regsvr32.exe
2488	YoudaoDictInstaller.exe
2488	YoudaoDictInstaller.exe
2488	YoudaoDictInstaller.exe
2488	YoudaoDictInstaller.exe
1584	YoudaoDict_fanyiweb_navigation.exe
4412	regsvr32.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
5368	regsvr32.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
1584	YoudaoDict_fanyiweb_navigation.exe
7392	YoudaoDictInstaller.exe
7392	YoudaoDictInstaller.exe
1584	YoudaoDict_fanyiweb_navigation.exe
7568	YoudaoDictInstaller.exe
7568	YoudaoDictInstaller.exe
7568	YoudaoDictInstaller.exe
7568	YoudaoDictInstaller.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
5780	YoudaoDictHelper.exe
5780	YoudaoDictHelper.exe
5780	YoudaoDictHelper.exe
5780	YoudaoDictHelper.exe
5780	YoudaoDictHelper.exe
4044	YoudaoDictHelper.exe
4044	YoudaoDictHelper.exe
5584	YoudaoDictHelper.exe
5584	YoudaoDictHelper.exe
3972	YoudaoDictHelper.exe
3972	YoudaoDictHelper.exe
4100	YoudaoDictHelper.exe
4100	YoudaoDictHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2296	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI8B27.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDict.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI8AE6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDict_fanyiweb_navigation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoEDIT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1268	cmd.exe
12536	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Phxph.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Phxph.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Phxph.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Phxph.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	Phxph.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Phxph.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	Phxph.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell\open\command	YoudaoDictInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect.1\CLSID\ = "{07473267-2FBF-468D-8C7D-A9DB6211F5F2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord32.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\TypeLib\ = "{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\ = "YoudaoGetWord 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\YoudaoDict.exe\" \"-startWithParam\" \"DeepLink\" \"%1\""	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\VersionIndependentProgID\ = "YoudaoGetWord64.Connect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\VersionIndependentProgID\ = "YoudaoGetWord32.Connect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\TypeLib\ = "{55684B24-475C-4969-8C82-B498B5A53596}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\ = "URL:yddict"	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\URL Protocol	YoudaoDictInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1\CLSID\ = "{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CurVer\ = "YoudaoGetWord32.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\CLSID\ = "{07473267-2FBF-468D-8C7D-A9DB6211F5F2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CLSID\ = "{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\ = "YoudaoGetWord 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\ProgID\ = "YoudaoGetWord32.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict	YoudaoDictInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect.1\ = "Connect Class"	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	YoudaoDict.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	YoudaoDict.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
12536	PING.EXE

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1684	msiexec.exe
1684	msiexec.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2792	Phxph.exe
2488	YoudaoDictInstaller.exe
2488	YoudaoDictInstaller.exe
5780	YoudaoDictHelper.exe
4044	YoudaoDictHelper.exe
5584	YoudaoDictHelper.exe
3972	YoudaoDictHelper.exe
4100	YoudaoDictHelper.exe
5424	YoudaoDictHelper.exe
10316	YoudaoDictHelper.exe
10456	YoudaoDictHelper.exe
1244	YoudaoDictHelper.exe
1364	YoudaoDictHelper.exe
896	YoudaoDictHelper.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2296	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeSecurityPrivilege	1684	msiexec.exe
Token: SeCreateTokenPrivilege	2296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2296	msiexec.exe
Token: SeLockMemoryPrivilege	2296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2296	msiexec.exe
Token: SeMachineAccountPrivilege	2296	msiexec.exe
Token: SeTcbPrivilege	2296	msiexec.exe
Token: SeSecurityPrivilege	2296	msiexec.exe
Token: SeTakeOwnershipPrivilege	2296	msiexec.exe
Token: SeLoadDriverPrivilege	2296	msiexec.exe
Token: SeSystemProfilePrivilege	2296	msiexec.exe
Token: SeSystemtimePrivilege	2296	msiexec.exe
Token: SeProfSingleProcessPrivilege	2296	msiexec.exe
Token: SeIncBasePriorityPrivilege	2296	msiexec.exe
Token: SeCreatePagefilePrivilege	2296	msiexec.exe
Token: SeCreatePermanentPrivilege	2296	msiexec.exe
Token: SeBackupPrivilege	2296	msiexec.exe
Token: SeRestorePrivilege	2296	msiexec.exe
Token: SeShutdownPrivilege	2296	msiexec.exe
Token: SeDebugPrivilege	2296	msiexec.exe
Token: SeAuditPrivilege	2296	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2296	msiexec.exe
Token: SeChangeNotifyPrivilege	2296	msiexec.exe
Token: SeRemoteShutdownPrivilege	2296	msiexec.exe
Token: SeUndockPrivilege	2296	msiexec.exe
Token: SeSyncAgentPrivilege	2296	msiexec.exe
Token: SeEnableDelegationPrivilege	2296	msiexec.exe
Token: SeManageVolumePrivilege	2296	msiexec.exe
Token: SeImpersonatePrivilege	2296	msiexec.exe
Token: SeCreateGlobalPrivilege	2296	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeIncBasePriorityPrivilege	2216	SoftUpdate.exe
Token: 33	2792	Phxph.exe
Token: SeIncBasePriorityPrivilege	2792	Phxph.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2296	msiexec.exe
2296	msiexec.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
12684	YoudaoDictInstaller.exe
13308	YoudaoDictInstaller.exe
13308	YoudaoDictInstaller.exe
2488	YoudaoDictInstaller.exe
7336	YoudaoDictInstaller.exe
7392	YoudaoDictInstaller.exe
7568	YoudaoDictInstaller.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10220	YoudaoDict.exe
10356	YoudaoWSH.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 2840	1684	msiexec.exe	29
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 1888	1684	msiexec.exe	30
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 1684 wrote to memory of 2588	1684	msiexec.exe	31
PID 2560 wrote to memory of 2792	2560	Phxph.exe	38
PID 2560 wrote to memory of 2792	2560	Phxph.exe	38
PID 2560 wrote to memory of 2792	2560	Phxph.exe	38
PID 2560 wrote to memory of 2792	2560	Phxph.exe	38
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 2216 wrote to memory of 1268	2216	SoftUpdate.exe	37
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1268 wrote to memory of 12536	1268	cmd.exe	40
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 12684	1584	YoudaoDict_fanyiweb_navigation.exe	41
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 13308	1584	YoudaoDict_fanyiweb_navigation.exe	42
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 3196	1584	YoudaoDict_fanyiweb_navigation.exe	43
PID 1584 wrote to memory of 2672	1584	YoudaoDict_fanyiweb_navigation.exe	44
PID 1584 wrote to memory of 2672	1584	YoudaoDict_fanyiweb_navigation.exe	44
PID 1584 wrote to memory of 2672	1584	YoudaoDict_fanyiweb_navigation.exe	44
PID 1584 wrote to memory of 2672	1584	YoudaoDict_fanyiweb_navigation.exe	44

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\YoudaodcDictSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1BAADF82274815749D95499577D0051
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Windows\Installer\MSI8AE6.tmp
  "C:\Windows\Installer\MSI8AE6.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\Installer\MSI8B27.tmp
  "C:\Windows\Installer\MSI8B27.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2588

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe
"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe" "nsiinstall" "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\install.ini" "0"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:12684
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe" rundicttask * "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe" "0"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:13308
- - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe
    "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:10220
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=gpu-process --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --no-sandbox --disable-logging --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADhAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=4828 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5780
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --lang=en-US --service-sandbox-type=utility --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3972
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4044
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4100
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5584
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5836 /prefetch:1
      4⤵
      Uses browser remote debugging
      Executes dropped EXE
      PID:4088
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=gpu-process --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --no-sandbox --disable-logging --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADhAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=4992 /prefetch:2
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5424
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=6900 /prefetch:1
      4⤵
      Uses browser remote debugging
      Executes dropped EXE
      PID:9188
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      Uses browser remote debugging
      Executes dropped EXE
      PID:9260
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoWSH.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoWSH.exe" 10220
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:10356
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoEDIT.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoEDIT.exe" 10220
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:10400
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=6696 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1244
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6748 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:10316
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:10456
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:896
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 6.1.7601; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=4820,3814580886822085028,18056755494809812755,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6880 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1364
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe" "exports" "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\dict.7z" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0"
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\YodaoDict.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YodaoDict.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\YoudaoDict.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\11.0.0.0" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\Stable" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\Stable"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe" install "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\install.ini" "full" 0
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2488
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\stable\YoudaoGetWord32.dll" /s
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4340
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\stable\YoudaoGetWord64.dll" /s
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4412
  - - C:\Windows\system32\regsvr32.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\stable\YoudaoGetWord64.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo y| cacls "C:\ProgramData\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5620
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe" "rundictnow" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7336
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictInstaller.exe" "cleanup" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7392
- C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictIcon.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8D34.tmp\YoudaoDictIcon.exe"
  2⤵
  - Executes dropped EXE
  PID:7488
- C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe" instreport
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7568

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:12536

C:\Windows\SysWOW64\Phxph.exe
C:\Windows\SysWOW64\Phxph.exe -auto
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\Phxph.exe
  C:\Windows\SysWOW64\Phxph.exe -acsi
  2⤵
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery