gh0strat | 39ae2756ab3ab2d86533344ddf0fc1e7fc14b8d271bb9321bbbf38909013173c

pid	Process
25584	YoudaoDictHelper.exe
27588	YoudaoDictHelper.exe
27628	YoudaoDictHelper.exe
26772	YoudaoDictHelper.exe
26312	YoudaoDictHelper.exe
26188	YoudaoDictHelper.exe
26172	YoudaoDictHelper.exe
25564	YoudaoDictHelper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YoudaoDict = "\"C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\YoudaoDict.exe\" -hide -autostart"	YoudaoDict_fanyiweb_navigation.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YoudaoDict = "\"C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\YoudaoDict.exe\" -hide -autostart"	YoudaoDictInstaller.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	Phxph.exe
File opened (read-only)	\??\K:	Phxph.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	Phxph.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	Phxph.exe
File opened (read-only)	\??\W:	Phxph.exe
File opened (read-only)	\??\Z:	Phxph.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	Phxph.exe
File opened (read-only)	\??\J:	Phxph.exe
File opened (read-only)	\??\Q:	Phxph.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	Phxph.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	Phxph.exe
File opened (read-only)	\??\S:	Phxph.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	Phxph.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	Phxph.exe
File opened (read-only)	\??\Y:	Phxph.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	Phxph.exe
File opened (read-only)	\??\L:	Phxph.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	Phxph.exe
File opened (read-only)	\??\O:	Phxph.exe
File opened (read-only)	\??\X:	Phxph.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	Phxph.exe
File opened (read-only)	\??\V:	Phxph.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDict.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	YoudaoDictHelper.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Phxph.exe	SoftUpdate.exe
File created	C:\Windows\SysWOW64\Phxph.exe	SoftUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs

pid	Process
4444	SoftUpdate.exe
4444	SoftUpdate.exe
16840	Phxph.exe
4444	SoftUpdate.exe
16840	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\YodaoDict.api	YoudaoDictInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\YodaoDict.api	YoudaoDictInstaller.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC055.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0E3.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC57A.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC52B.tmp	msiexec.exe
File created	C:\Windows\Installer\e57bbfd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57bbfd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD64.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC035.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E8EEAEFA-C0C5-47EC-A127-5C05F23C0959}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC355.tmp	msiexec.exe

Executes dropped EXE 35 IoCs

pid	Process
4992	MSIC52B.tmp
968	MSIC57A.tmp
4444	SoftUpdate.exe
4548	YoudaoDict_fanyiweb_navigation.exe
16840	Phxph.exe
50796	Phxph.exe
42608	YoudaoDictInstaller.exe
41940	YoudaoDictInstaller.exe
41756	InstallHelper.exe
31356	InstallHelper.exe
31308	InstallHelper.exe
31260	InstallHelper.exe
31220	InstallHelper.exe
31140	YoudaoDictInstaller.exe
28856	YoudaoDictInstaller.exe
28864	YoudaoDictInstaller.exe
28832	YoudaoDictIcon.exe
28808	YoudaoDictInstaller.exe
28356	YoudaoDict.exe
27736	YoudaoDictHelper.exe
27656	YoudaoDictHelper.exe
27628	YoudaoDictHelper.exe
27668	YoudaoDictHelper.exe
27588	YoudaoDictHelper.exe
27092	YoudaoDictHelper.exe
26772	YoudaoDictHelper.exe
26352	YoudaoWSH.exe
26332	YoudaoEDIT.exe
2496	Process not Found
2772	Process not Found
26312	YoudaoDictHelper.exe
26188	YoudaoDictHelper.exe
26172	YoudaoDictHelper.exe
25584	YoudaoDictHelper.exe
25564	YoudaoDictHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
4548	YoudaoDict_fanyiweb_navigation.exe
31044	regsvr32.exe
31032	regsvr32.exe
30968	regsvr32.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
27656	YoudaoDictHelper.exe
27588	YoudaoDictHelper.exe
27588	YoudaoDictHelper.exe
27656	YoudaoDictHelper.exe
27628	YoudaoDictHelper.exe
27628	YoudaoDictHelper.exe
27668	YoudaoDictHelper.exe
27668	YoudaoDictHelper.exe
27736	YoudaoDictHelper.exe
27736	YoudaoDictHelper.exe
27588	YoudaoDictHelper.exe
27628	YoudaoDictHelper.exe
27736	YoudaoDictHelper.exe
27736	YoudaoDictHelper.exe
27736	YoudaoDictHelper.exe
27092	YoudaoDictHelper.exe
27092	YoudaoDictHelper.exe
28356	YoudaoDict.exe
26352	YoudaoWSH.exe
28356	YoudaoDict.exe
3520	Process not Found
26332	YoudaoEDIT.exe
26312	YoudaoDictHelper.exe
26312	YoudaoDictHelper.exe
26312	YoudaoDictHelper.exe
26312	YoudaoDictHelper.exe
26172	YoudaoDictHelper.exe
26172	YoudaoDictHelper.exe
26172	YoudaoDictHelper.exe
26188	YoudaoDictHelper.exe
26172	YoudaoDictHelper.exe
26188	YoudaoDictHelper.exe
26188	YoudaoDictHelper.exe
26188	YoudaoDictHelper.exe
25584	YoudaoDictHelper.exe
25564	YoudaoDictHelper.exe
25584	YoudaoDictHelper.exe
25564	YoudaoDictHelper.exe
25584	YoudaoDictHelper.exe
25564	YoudaoDictHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
860	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC57A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDict.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoEDIT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDict_fanyiweb_navigation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC52B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictHelper.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
50784	cmd.exe
43112	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Phxph.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Phxph.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Phxph.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Phxph.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell\open	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect.1\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\ = "URL:yddict"	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1\CLSID\ = "{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\URL Protocol	YoudaoDictInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CurVer\ = "YoudaoGetWord32.Connect.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\TypeLib\ = "{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CLSID\ = "{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\TypeLib\ = "{55684B24-475C-4969-8C82-B498B5A53596}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict	YoudaoDictInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect.1\CLSID\ = "{07473267-2FBF-468D-8C7D-A9DB6211F5F2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\VersionIndependentProgID\ = "YoudaoGetWord32.Connect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\ProgID\ = "YoudaoGetWord64.Connect.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\ = "YoudaoGetWord 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell\open\command	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\VersionIndependentProgID\ = "YoudaoGetWord64.Connect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\ProgID\ = "YoudaoGetWord32.Connect.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0\ = "YoudaoGetWord 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07473267-2FBF-468D-8C7D-A9DB6211F5F2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55684B24-475C-4969-8C82-B498B5A53596}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\yddict\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Youdao\\Dict\\Application\\YoudaoDict.exe\" \"-startWithParam\" \"DeepLink\" \"%1\""	YoudaoDictInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord64.Connect	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoudaoGetWord32.Connect.1\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\VersionIndependentProgID	regsvr32.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	YoudaoDict.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	YoudaoDict.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	YoudaoDict.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
43112	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3764	msiexec.exe
3764	msiexec.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe
50796	Phxph.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	860	msiexec.exe
Token: SeSecurityPrivilege	3764	msiexec.exe
Token: SeCreateTokenPrivilege	860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	860	msiexec.exe
Token: SeLockMemoryPrivilege	860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	860	msiexec.exe
Token: SeMachineAccountPrivilege	860	msiexec.exe
Token: SeTcbPrivilege	860	msiexec.exe
Token: SeSecurityPrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeLoadDriverPrivilege	860	msiexec.exe
Token: SeSystemProfilePrivilege	860	msiexec.exe
Token: SeSystemtimePrivilege	860	msiexec.exe
Token: SeProfSingleProcessPrivilege	860	msiexec.exe
Token: SeIncBasePriorityPrivilege	860	msiexec.exe
Token: SeCreatePagefilePrivilege	860	msiexec.exe
Token: SeCreatePermanentPrivilege	860	msiexec.exe
Token: SeBackupPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeShutdownPrivilege	860	msiexec.exe
Token: SeDebugPrivilege	860	msiexec.exe
Token: SeAuditPrivilege	860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	860	msiexec.exe
Token: SeChangeNotifyPrivilege	860	msiexec.exe
Token: SeRemoteShutdownPrivilege	860	msiexec.exe
Token: SeUndockPrivilege	860	msiexec.exe
Token: SeSyncAgentPrivilege	860	msiexec.exe
Token: SeEnableDelegationPrivilege	860	msiexec.exe
Token: SeManageVolumePrivilege	860	msiexec.exe
Token: SeImpersonatePrivilege	860	msiexec.exe
Token: SeCreateGlobalPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeIncBasePriorityPrivilege	4444	SoftUpdate.exe
Token: 33	50796	Phxph.exe
Token: SeIncBasePriorityPrivilege	50796	Phxph.exe
Token: 33	50796	Phxph.exe
Token: SeIncBasePriorityPrivilege	50796	Phxph.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
860	msiexec.exe
860	msiexec.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
42608	YoudaoDictInstaller.exe
41940	YoudaoDictInstaller.exe
41940	YoudaoDictInstaller.exe
31140	YoudaoDictInstaller.exe
28864	YoudaoDictInstaller.exe
28856	YoudaoDictInstaller.exe
28808	YoudaoDictInstaller.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
28356	YoudaoDict.exe
26352	YoudaoWSH.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe
26332	YoudaoEDIT.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2332	3764	msiexec.exe	87
PID 3764 wrote to memory of 2332	3764	msiexec.exe	87
PID 3764 wrote to memory of 2332	3764	msiexec.exe	87
PID 3764 wrote to memory of 4992	3764	msiexec.exe	91
PID 3764 wrote to memory of 4992	3764	msiexec.exe	91
PID 3764 wrote to memory of 4992	3764	msiexec.exe	91
PID 3764 wrote to memory of 968	3764	msiexec.exe	92
PID 3764 wrote to memory of 968	3764	msiexec.exe	92
PID 3764 wrote to memory of 968	3764	msiexec.exe	92
PID 4444 wrote to memory of 50784	4444	SoftUpdate.exe	98
PID 4444 wrote to memory of 50784	4444	SoftUpdate.exe	98
PID 4444 wrote to memory of 50784	4444	SoftUpdate.exe	98
PID 16840 wrote to memory of 50796	16840	Phxph.exe	99
PID 16840 wrote to memory of 50796	16840	Phxph.exe	99
PID 16840 wrote to memory of 50796	16840	Phxph.exe	99
PID 50784 wrote to memory of 43112	50784	cmd.exe	101
PID 50784 wrote to memory of 43112	50784	cmd.exe	101
PID 50784 wrote to memory of 43112	50784	cmd.exe	101
PID 4548 wrote to memory of 42608	4548	YoudaoDict_fanyiweb_navigation.exe	106
PID 4548 wrote to memory of 42608	4548	YoudaoDict_fanyiweb_navigation.exe	106
PID 4548 wrote to memory of 42608	4548	YoudaoDict_fanyiweb_navigation.exe	106
PID 4548 wrote to memory of 41940	4548	YoudaoDict_fanyiweb_navigation.exe	108
PID 4548 wrote to memory of 41940	4548	YoudaoDict_fanyiweb_navigation.exe	108
PID 4548 wrote to memory of 41940	4548	YoudaoDict_fanyiweb_navigation.exe	108
PID 4548 wrote to memory of 41756	4548	YoudaoDict_fanyiweb_navigation.exe	112
PID 4548 wrote to memory of 41756	4548	YoudaoDict_fanyiweb_navigation.exe	112
PID 4548 wrote to memory of 41756	4548	YoudaoDict_fanyiweb_navigation.exe	112
PID 4548 wrote to memory of 31356	4548	YoudaoDict_fanyiweb_navigation.exe	114
PID 4548 wrote to memory of 31356	4548	YoudaoDict_fanyiweb_navigation.exe	114
PID 4548 wrote to memory of 31356	4548	YoudaoDict_fanyiweb_navigation.exe	114
PID 4548 wrote to memory of 31308	4548	YoudaoDict_fanyiweb_navigation.exe	115
PID 4548 wrote to memory of 31308	4548	YoudaoDict_fanyiweb_navigation.exe	115
PID 4548 wrote to memory of 31308	4548	YoudaoDict_fanyiweb_navigation.exe	115
PID 4548 wrote to memory of 31260	4548	YoudaoDict_fanyiweb_navigation.exe	116
PID 4548 wrote to memory of 31260	4548	YoudaoDict_fanyiweb_navigation.exe	116
PID 4548 wrote to memory of 31260	4548	YoudaoDict_fanyiweb_navigation.exe	116
PID 4548 wrote to memory of 31220	4548	YoudaoDict_fanyiweb_navigation.exe	117
PID 4548 wrote to memory of 31220	4548	YoudaoDict_fanyiweb_navigation.exe	117
PID 4548 wrote to memory of 31220	4548	YoudaoDict_fanyiweb_navigation.exe	117
PID 4548 wrote to memory of 31140	4548	YoudaoDict_fanyiweb_navigation.exe	118
PID 4548 wrote to memory of 31140	4548	YoudaoDict_fanyiweb_navigation.exe	118
PID 4548 wrote to memory of 31140	4548	YoudaoDict_fanyiweb_navigation.exe	118
PID 31140 wrote to memory of 31044	31140	YoudaoDictInstaller.exe	119
PID 31140 wrote to memory of 31044	31140	YoudaoDictInstaller.exe	119
PID 31140 wrote to memory of 31044	31140	YoudaoDictInstaller.exe	119
PID 31140 wrote to memory of 31032	31140	YoudaoDictInstaller.exe	120
PID 31140 wrote to memory of 31032	31140	YoudaoDictInstaller.exe	120
PID 31140 wrote to memory of 31032	31140	YoudaoDictInstaller.exe	120
PID 31032 wrote to memory of 30968	31032	regsvr32.exe	121
PID 31032 wrote to memory of 30968	31032	regsvr32.exe	121
PID 31140 wrote to memory of 30956	31140	YoudaoDictInstaller.exe	122
PID 31140 wrote to memory of 30956	31140	YoudaoDictInstaller.exe	122
PID 31140 wrote to memory of 30956	31140	YoudaoDictInstaller.exe	122
PID 30956 wrote to memory of 29716	30956	cmd.exe	124
PID 30956 wrote to memory of 29716	30956	cmd.exe	124
PID 30956 wrote to memory of 29716	30956	cmd.exe	124
PID 30956 wrote to memory of 29708	30956	cmd.exe	125
PID 30956 wrote to memory of 29708	30956	cmd.exe	125
PID 30956 wrote to memory of 29708	30956	cmd.exe	125
PID 4548 wrote to memory of 28864	4548	YoudaoDict_fanyiweb_navigation.exe	129
PID 4548 wrote to memory of 28864	4548	YoudaoDict_fanyiweb_navigation.exe	129
PID 4548 wrote to memory of 28864	4548	YoudaoDict_fanyiweb_navigation.exe	129
PID 4548 wrote to memory of 28856	4548	YoudaoDict_fanyiweb_navigation.exe	130
PID 4548 wrote to memory of 28856	4548	YoudaoDict_fanyiweb_navigation.exe	130

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\YoudaodcDictSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C6BEBE2BD35806B25B6FEA7B5FAFB842
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2332
- C:\Windows\Installer\MSIC52B.tmp
  "C:\Windows\Installer\MSIC52B.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992
- C:\Windows\Installer\MSIC57A.tmp
  "C:\Windows\Installer\MSIC57A.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:968

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:50784
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:43112

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe
"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe" "nsiinstall" "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\install.ini" "0"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:42608
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe" rundicttask * "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe" "0"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:41940
- - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe
    "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:28356
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=gpu-process --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --no-sandbox --disable-logging --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADhAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=5716 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27736
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --lang=en-US --service-sandbox-type=utility --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=5940 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27668
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=5968 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27656
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=6416 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27628
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=6516 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27588
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=gpu-process --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --no-sandbox --disable-logging --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADhAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --mojo-platform-channel-handle=4880 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27092
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      Uses browser remote debugging
      Executes dropped EXE
      PID:26772
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoWSH.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoWSH.exe" 28356
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:26352
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoEDIT.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoEDIT.exe" 28356
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:26332
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=7784 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:26312
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=7968 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:26188
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=7932 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:26172
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=7816 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:25584
  - - C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictHelper.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0" --user-agent="Mozilla/5.0 (Windows NT 10.0.19041; WOW64) Chrome/97.0.4692.99 youdaodict/11.0.0 (jsbridge/1.0;windowspc) YDUIStyle/Light" --uncaught-exception-stack-size=3 --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-accelerated-video-decode --disable-databases --disable-file-system --disable-logging --log-file="C:\Users\Admin\AppData\Local\Youdao\Dict\Application\debug.log" --remote-debugging-port=65123 --touch-events --js-flags=--jitless --field-trial-handle=5700,7639049231551937455,12843379606161537929,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=8040 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:25564
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe" "exports" "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\dict.7z" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:41756
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\YodaoDict.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YodaoDict.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:31356
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\YoudaoDict.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:31308
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\11.0.0.0" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:31260
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\InstallHelper.exe" "move" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\install_11.0.0.0\Stable" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\Stable"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:31220
- C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe" install "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\install.ini" "full" 0
  2⤵
  - Adds Run key to start application
  - Checks computer location settings
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:31140
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\stable\YoudaoGetWord32.dll" /s
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:31044
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\stable\YoudaoGetWord64.dll" /s
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:31032
  - - C:\Windows\system32\regsvr32.exe
      "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\stable\YoudaoGetWord64.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:30968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo y| cacls "C:\ProgramData\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:30956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:29716
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f
      4⤵
      System Location Discovery: System Language Discovery
      PID:29708
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe" "rundictnow" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\YoudaoDict.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:28864
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictInstaller.exe" "cleanup" "C:\Users\Admin\AppData\Local\Youdao\Dict\Application"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:28856
- C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictIcon.exe
  "C:\Users\Admin\AppData\Local\Temp\nspD0DF.tmp\YoudaoDictIcon.exe"
  2⤵
  - Executes dropped EXE
  PID:28832
- C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe
  "C:\Users\Admin\AppData\Local\Youdao\Dict\Application\11.0.0.0\YoudaoDictInstaller.exe" instreport
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:28808

C:\Windows\SysWOW64\Phxph.exe
C:\Windows\SysWOW64\Phxph.exe -auto
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:16840
- C:\Windows\SysWOW64\Phxph.exe
  C:\Windows\SysWOW64\Phxph.exe -acsi
  2⤵
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:50796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery