Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 06:03
Static task
static1
Behavioral task
behavioral1
Sample
kugou_yinyue-X64.msi
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
kugou_yinyue-X64.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
kugou_yinyue-X64.msi
-
Size
115.7MB
-
MD5
8264ac335dd2c9b6f3c22826833eef9a
-
SHA1
6b45e44fb10381e96e5cba2004bfbc08a3eec3cd
-
SHA256
4defef20d0c620fcc1743147f44a244fa7c61b484a5ca5cfb8f60e99e970a7a2
-
SHA512
1a65be0f908edabe532232193cab034921065ff4fb898637b1c82a17d29874335758c93f779b7666384c0d6e6fe4eb46b5a6882986d6b742dd1a8be0e1df2fbb
-
SSDEEP
3145728:rydOHVo966Gx85U9YwMWYA2/8JZVtG37GDOUaDZjfFSfho:0H1GxkcBrYt/8J8SarDZ7FSfu
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1584 powershell.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\DeployDeterminedRetailer\yINMOeuVvrtK.exe UsfWMVCzYNmv.exe File created C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw.vbs YbAWjEbpulWw.exe File created C:\Program Files\DeployDeterminedRetailer\QnEAZeOBmPdAEfzPaPmE msiexec.exe File created C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw UsfWMVCzYNmv.exe File opened for modification C:\Program Files\DeployDeterminedRetailer\yINMOeuVvrtK.xml UsfWMVCzYNmv.exe File opened for modification C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw UsfWMVCzYNmv.exe File created C:\Program Files\DeployDeterminedRetailer\yINMOeuVvrtK.xml UsfWMVCzYNmv.exe File created C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw.exe UsfWMVCzYNmv.exe File opened for modification C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw.exe UsfWMVCzYNmv.exe File created C:\Program Files\DeployDeterminedRetailer\yINMOeuVvrtK.exe UsfWMVCzYNmv.exe File created C:\Program Files\DeployDeterminedRetailer\kugou11131.exe msiexec.exe File created C:\Program Files\DeployDeterminedRetailer\UsfWMVCzYNmv.exe msiexec.exe File created C:\Program Files\DeployDeterminedRetailer\valibclang2d.dll msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76c11d.msi msiexec.exe File created C:\Windows\Installer\f76c11e.ipi msiexec.exe File created C:\Windows\Installer\f76c120.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.app.log YbAWjEbpulWw.exe File opened for modification C:\Windows\Installer\f76c11e.ipi msiexec.exe File created C:\Windows\Installer\f76c11d.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIDD73.tmp msiexec.exe -
Executes dropped EXE 3 IoCs
pid Process 3048 UsfWMVCzYNmv.exe 2112 YbAWjEbpulWw.exe 2960 kugou11131.exe -
Loads dropped DLL 4 IoCs
pid Process 2960 kugou11131.exe 2960 kugou11131.exe 2960 kugou11131.exe 2960 kugou11131.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2096 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UsfWMVCzYNmv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YbAWjEbpulWw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kugou11131.exe -
Modifies data under HKEY_USERS 51 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d0863dad7f39db01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 kugou11131.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E kugou11131.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet." kugou11131.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\ProductName = "DeployDeterminedRetailer" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9D51F0087DFCA064380A9EB28F253D2C\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\Version = "151388165" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B111F7821E44204F86D3FB2C9D25454\9D51F0087DFCA064380A9EB28F253D2C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\SourceList\PackageName = "kugou_yinyue-X64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9D51F0087DFCA064380A9EB28F253D2C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\PackageCode = "2B31C87B8EF03FF46879ADE5DD5B9979" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D51F0087DFCA064380A9EB28F253D2C\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B111F7821E44204F86D3FB2C9D25454 msiexec.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 3048 UsfWMVCzYNmv.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2380 msiexec.exe 2380 msiexec.exe 1584 powershell.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe 2112 YbAWjEbpulWw.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeSecurityPrivilege 2380 msiexec.exe Token: SeCreateTokenPrivilege 2096 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2096 msiexec.exe Token: SeLockMemoryPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeMachineAccountPrivilege 2096 msiexec.exe Token: SeTcbPrivilege 2096 msiexec.exe Token: SeSecurityPrivilege 2096 msiexec.exe Token: SeTakeOwnershipPrivilege 2096 msiexec.exe Token: SeLoadDriverPrivilege 2096 msiexec.exe Token: SeSystemProfilePrivilege 2096 msiexec.exe Token: SeSystemtimePrivilege 2096 msiexec.exe Token: SeProfSingleProcessPrivilege 2096 msiexec.exe Token: SeIncBasePriorityPrivilege 2096 msiexec.exe Token: SeCreatePagefilePrivilege 2096 msiexec.exe Token: SeCreatePermanentPrivilege 2096 msiexec.exe Token: SeBackupPrivilege 2096 msiexec.exe Token: SeRestorePrivilege 2096 msiexec.exe Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeDebugPrivilege 2096 msiexec.exe Token: SeAuditPrivilege 2096 msiexec.exe Token: SeSystemEnvironmentPrivilege 2096 msiexec.exe Token: SeChangeNotifyPrivilege 2096 msiexec.exe Token: SeRemoteShutdownPrivilege 2096 msiexec.exe Token: SeUndockPrivilege 2096 msiexec.exe Token: SeSyncAgentPrivilege 2096 msiexec.exe Token: SeEnableDelegationPrivilege 2096 msiexec.exe Token: SeManageVolumePrivilege 2096 msiexec.exe Token: SeImpersonatePrivilege 2096 msiexec.exe Token: SeCreateGlobalPrivilege 2096 msiexec.exe Token: SeBackupPrivilege 2688 vssvc.exe Token: SeRestorePrivilege 2688 vssvc.exe Token: SeAuditPrivilege 2688 vssvc.exe Token: SeBackupPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeBackupPrivilege 2740 vssvc.exe Token: SeRestorePrivilege 2740 vssvc.exe Token: SeAuditPrivilege 2740 vssvc.exe Token: SeBackupPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2636 DrvInst.exe Token: SeLoadDriverPrivilege 2636 DrvInst.exe Token: SeLoadDriverPrivilege 2636 DrvInst.exe Token: SeLoadDriverPrivilege 2636 DrvInst.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeDebugPrivilege 1584 powershell.exe Token: SeRestorePrivilege 3048 UsfWMVCzYNmv.exe Token: 35 3048 UsfWMVCzYNmv.exe Token: SeSecurityPrivilege 3048 UsfWMVCzYNmv.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2096 msiexec.exe 2096 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2960 kugou11131.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2880 2688 vssvc.exe 33 PID 2688 wrote to memory of 2880 2688 vssvc.exe 33 PID 2688 wrote to memory of 2880 2688 vssvc.exe 33 PID 2380 wrote to memory of 1956 2380 msiexec.exe 37 PID 2380 wrote to memory of 1956 2380 msiexec.exe 37 PID 2380 wrote to memory of 1956 2380 msiexec.exe 37 PID 2380 wrote to memory of 1956 2380 msiexec.exe 37 PID 2380 wrote to memory of 1956 2380 msiexec.exe 37 PID 1956 wrote to memory of 1584 1956 MsiExec.exe 39 PID 1956 wrote to memory of 1584 1956 MsiExec.exe 39 PID 1956 wrote to memory of 1584 1956 MsiExec.exe 39 PID 1956 wrote to memory of 1588 1956 MsiExec.exe 41 PID 1956 wrote to memory of 1588 1956 MsiExec.exe 41 PID 1956 wrote to memory of 1588 1956 MsiExec.exe 41 PID 1588 wrote to memory of 3048 1588 cmd.exe 43 PID 1588 wrote to memory of 3048 1588 cmd.exe 43 PID 1588 wrote to memory of 3048 1588 cmd.exe 43 PID 1588 wrote to memory of 3048 1588 cmd.exe 43 PID 1956 wrote to memory of 2112 1956 MsiExec.exe 45 PID 1956 wrote to memory of 2112 1956 MsiExec.exe 45 PID 1956 wrote to memory of 2112 1956 MsiExec.exe 45 PID 1956 wrote to memory of 2112 1956 MsiExec.exe 45 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 PID 1956 wrote to memory of 2960 1956 MsiExec.exe 46 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\kugou_yinyue-X64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2096
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 57B259D4E938DBC19927DCB2DB8C2D43 M Global\MSI00002⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DeployDeterminedRetailer'3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Program Files\DeployDeterminedRetailer\UsfWMVCzYNmv.exe" x "C:\Program Files\DeployDeterminedRetailer\QnEAZeOBmPdAEfzPaPmE" -o"C:\Program Files\DeployDeterminedRetailer\" -pkYpyaRvRcFdTfVUfUNOC -y3⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Program Files\DeployDeterminedRetailer\UsfWMVCzYNmv.exe"C:\Program Files\DeployDeterminedRetailer\UsfWMVCzYNmv.exe" x "C:\Program Files\DeployDeterminedRetailer\QnEAZeOBmPdAEfzPaPmE" -o"C:\Program Files\DeployDeterminedRetailer\" -pkYpyaRvRcFdTfVUfUNOC -y4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
-
C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw.exe"C:\Program Files\DeployDeterminedRetailer\YbAWjEbpulWw.exe" -number 289 -file file3 -mode mode33⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Program Files\DeployDeterminedRetailer\kugou11131.exe"C:\Program Files\DeployDeterminedRetailer\kugou11131.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2688 -s 5802⤵PID:2880
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005DC" "00000000000003AC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD55b4c9421d3fd5cac63a0d801c7d1c80d
SHA1419725c22a2b4594948f29d07d6dca4f76d8f797
SHA25619c1bf4738ec664d17074de033ece34a351b674f7f9e55801a77c791a489d2e0
SHA512e1a8632f8f1346985ebc009d6a09586992e09499de6d32d265c4b0acfa0e9b46405b3a61108d2dfa5a8ba0d63e19f2635e0ae17e7d7cf248448bdd51ce15ccdb
-
Filesize
1.5MB
MD5f97e41d5d36b59621dba93d7727cb67b
SHA1b2e9e34874a9cb8c61fc276b9d77a0e1cb0532f0
SHA256a85e5b6d77e5ddc9f00155f1cda319508c92c8e21c16bd99cfc87b15ae774174
SHA512c8de402c10fb3505a7ef7b7ec8039f03b5810e6c38d7b2969865148f0a1ed21e798f386aae9ca2cb1655184accac39169d59cc7e6662ffa213c7a0edc4cd8c67
-
Filesize
577KB
MD5c31c4b04558396c6fabab64dcf366534
SHA1fa836d92edc577d6a17ded47641ba1938589b09a
SHA2569d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3
SHA512814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99
-
Filesize
2.1MB
MD513c482a12d740c8fc27b23038fa097d4
SHA14c0d85646dfa60d3dbe9bab472fe1ef3ae8da957
SHA256f12ea05152c21c0de7b9f81b9e9004a40ee7f3c4cf7b63b7918d53c74a1219a6
SHA51273a1df4797a092de6b5fbede88a96d593ba34198f32f44eb390e223ebd0df988e114a7caa19de723b15698fcf884943f004a2d35d4bbd3c2ae18155594e74bbf
-
Filesize
40KB
MD588513dbed3a5bba74d020b0d56ae587a
SHA1f0f4f6f7e5e423ad1918ea553aa9e5c2ca75370a
SHA256cbce0c9051e6f4724070186feb71255e01f606f6f0d2ca1d2fcbc8c942d8e11f
SHA5126a61e4700c286202741cb344b4f6851573084b2dd78639f642252a9d5bcc35734fc7daa9d4e5d083577a0d4887d5a4a20ac04100b178205269fe13eb9d7393a7
-
Filesize
1.4MB
MD5c65109a207007208ef83b48de15d1145
SHA1d76057c4e67f850c2100c31c1222618efeed146b
SHA2564aaffbd45bc8d3498c76f78dba9b95f920367af37020e382099961437e89d071
SHA512b2c34bfb1ff5b3272780e9d2f89ff09e2146daa783f3a860aa30cac06b28c6063f2349cc30dd20e154565ad1e6310cd45d33e683f336c8f4905ebd15e5543370
-
Filesize
524KB
MD55a671b81a0d59cd5192b1861b65f2543
SHA1f679af0550a31a5cfbaa1b055cfaf2396027e391
SHA2565c7b02317096c5fe6fcfe173711e06aeb288c916e97a2abfe5939907744e0d97
SHA5126d76a6ac670e147335760a03288c6fc7e99c18611edfa859f4e76027bd937ac0a650479bdd2d09f9b94bb56bc81e3d292a42769c763971ff9a24d9566d22b442
-
Filesize
3.3MB
MD5f7b407c2c1600587cb6e5679a93250fb
SHA100b0cbedff910b4016cb957d6043eadb99575dd0
SHA2563ca02f89d98b7781c242b60029ddeb4f6b8610b624c0b70c6347a50b49f59024
SHA512428ae534ea6af1986f596b4a38b45926d2fe19cab09544fcc601a0a615e1ac45129e4eb88ac58489694b6b0c1a22514003eac5fdd0a7497cc719c1e047ad6624