34b150091d625d345d47c908841b2570455388c910e78e1403313fce2e5f2ae3

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XiuXiu_aam-X64.msi
Size

30.5MB
MD5

4bb380192889a55fb6c183f8053bedd1
SHA1

1016f0c66c398e28416a457d63f5e066edd7bffb
SHA256

34b150091d625d345d47c908841b2570455388c910e78e1403313fce2e5f2ae3
SHA512

00358460e128f3713a1c0ba7d9581bc7592c7bcb42de1d3201bed67a02884a0e31e7a7a672fa85a105736ddd6f4d6033bed85bc56699c1c96f5a1a018805ccb8
SSDEEP

786432:f+zvk6HbhSjB+x/d5AwL0DibF720rKyNvKbzpkYvRACCFc0yD:Wz869ScxF51L0mF7J+yYzpTZlAc0yD

Score

10^/10

bootkit discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

KKSetup_1008.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	KKSetup_1008.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\Meitu\KanKan\KanKan.exe = "C:\\Program Files (x86)\\Meitu\\KanKan\\KanKan.exe:*:Enabled:KanKan"	KKSetup_1008.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

800 powershell.exe
Downloads MZ/PE file
Drops desktop.ini file(s) 1 IoCs

Processes:

iexplore.exe

description ioc process

File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini iexplore.exe

pid	process
800	powershell.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	iexplore.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

KanKanST.exeXiuXiu_360Setup_4.0.1.exexiuxiu.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	KanKanST.exe
File opened for modification	\??\PhysicalDrive0	XiuXiu_360Setup_4.0.1.exe
File opened for modification	\??\PhysicalDrive0	xiuxiu.exe

Drops file in System32 directory 12 IoCs

Processes:

IEXPLORE.EXEiexplore.exepowershell.exeXiuXiu_360Setup_4.0.1.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0A17BC17FF10008872A7205D0D43E2_608DEF97DFACECDA8E97C6F270153A4F	IEXPLORE.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0A17BC17FF10008872A7205D0D43E2_608DEF97DFACECDA8E97C6F270153A4F	IEXPLORE.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8F8712BCE78D28F9C5E3E950CD93EADA_4648AEEB5A95A91D43B71C1DA0AE4E3B	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	iexplore.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\美图秀秀.lnk	XiuXiu_360Setup_4.0.1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8F8712BCE78D28F9C5E3E950CD93EADA_4648AEEB5A95A91D43B71C1DA0AE4E3B	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	iexplore.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

XiuXiu_360Setup_4.0.1.exeKKSetup_1008.exeKanKanPDF_Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_general_deelblue_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\ico_fore_statictext.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_main_recrop_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_member_ok_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\skin_newdlg_bottomleft.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\setting\sepr.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\toolbar\adressup.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_save_cancel_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\ico_fore_bigsina.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\control\floatbar_btnbg_mid.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_dlg_borderstyle1_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\SimplifiedChinese\Menu.ini	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_st_dgst_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\ico_save_success.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\SimplifiedChinese\DLGLEFTWORDEX.dat	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_edit_border2_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_openeffect_simple_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\member_signinico3.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_menu_ptedit_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\skin_floatdlg_bottomright.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\Sucai\Shipin\Egao\mtsc11594.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\ImgUI\login_bg.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\Sucai\Pintu\Moban\Biankuang\010.ptbj	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\icc\USWebUncoated.icc	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_meirong_mp_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\skin_filedlg_topright.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_general_bold_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_jgqt_tip_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_meirong_jmg_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\skin_effectdlg_topmiddle.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\SimplifiedChinese\DLGNEWLAYER.dat	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_general_blue2_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\ico_fore_puzzlemb.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\ico_fore_random.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\Sucai\Meirong\Jiafa\mtsc11293.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_main_picinformation_d.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\ico_fore_newqqkj.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Web\Dhsz\images\wzsc0001.gif	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\Sucai\Pintu\Moban\Diwen\mtsc101994.jpg	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_bg_magic_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_member_cancel_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\ico_fore_bizhencj.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_ellipse_color_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Web\Welcome\images\help\2.jpg	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\xiuxiu\Effects\mtxx_caiqian.jpg	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\control\homeendbg.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\bg_mp_generaladjust.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Web\Welcome\icon\5049cd3f9b2a7235.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\PlugIns\KanKanPDF\Skin\Default\control\SideSplitter.png	KanKanPDF_Setup.exe
File created	C:\Program Files (x86)\Meitu\xiuxiu\Resources\hlsl\mtpe_rttvs.fx	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_general_right_d.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_main_size_d.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\ico_iphone.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\xiuxiu\Effects\Particles\6_3.jpg	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\control\left.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_dlg_borderstyle1_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_dlg_restore_a.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_right_tab_c.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\Sucai\Shipin\Jieri\mtsc11361.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\toolbar\search_clear_hover.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_meirong_qdqb_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_pen_tuya_b.png	XiuXiu_360Setup_4.0.1.exe
File created	C:\Program Files (x86)\Meitu\KanKan\Skin\Default2.0\control\arrow_green.png	KKSetup_1008.exe
File created	C:\Program Files (x86)\Meitu\XiuXiu\Skins\blue\Images\btn_gengeral_blue_b.png	XiuXiu_360Setup_4.0.1.exe

Drops file in Windows directory 13 IoCs

Processes:

XiuXiu_360Setup_4.0.1.exemsiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\XiuXiu.ico	XiuXiu_360Setup_4.0.1.exe
File opened for modification	C:\Windows\Installer\f771d22.msi	msiexec.exe
File created	C:\Windows\Installer\f771d23.ipi	msiexec.exe
File created	C:\Windows\Installer\f771d25.msi	msiexec.exe
File created	C:\Windows\Installer\f771d22.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f771d23.ipi	msiexec.exe
File created	C:\Windows\wan.ico	XiuXiu_360Setup_4.0.1.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\uninstall.ico	XiuXiu_360Setup_4.0.1.exe

Executes dropped EXE 11 IoCs

Processes:

twtiuWMTMVYtAYTeUctRIfaDFjggmo.exetwtiuWMTMVYtAYTeUctRIfaDFjggmo.exejyPHAcnkRKeV.exeXiuXiu_360Setup_4.0.1.exeKKSetup_1008.exeKanKan.exemtkkDownload.exeKanKanST.exeKanKanPDF_Setup.exexiuxiu.exeMtHuaBao.exe

pid	process
1568	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
1576	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
2676	jyPHAcnkRKeV.exe
1108	XiuXiu_360Setup_4.0.1.exe
1584	KKSetup_1008.exe
1296	KanKan.exe
528	mtkkDownload.exe
2028	KanKanST.exe
2732	KanKanPDF_Setup.exe
1916	xiuxiu.exe
920	MtHuaBao.exe

Loads dropped DLL 64 IoCs

Processes:

XiuXiu_360Setup_4.0.1.exeKKSetup_1008.exemtkkDownload.exeKanKan.exeKanKanST.exeKanKanPDF_Setup.exexiuxiu.exe

pid	process
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1108	XiuXiu_360Setup_4.0.1.exe
1584	KKSetup_1008.exe
1108	XiuXiu_360Setup_4.0.1.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
528	mtkkDownload.exe
528	mtkkDownload.exe
528	mtkkDownload.exe
1296	KanKan.exe
1296	KanKan.exe
1296	KanKan.exe
1296	KanKan.exe
1296	KanKan.exe
1296	KanKan.exe
1296	KanKan.exe
2028	KanKanST.exe
2028	KanKanST.exe
2028	KanKanST.exe
2028	KanKanST.exe
2028	KanKanST.exe
528	mtkkDownload.exe
2732	KanKanPDF_Setup.exe
2732	KanKanPDF_Setup.exe
2732	KanKanPDF_Setup.exe
2732	KanKanPDF_Setup.exe
2732	KanKanPDF_Setup.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1108	XiuXiu_360Setup_4.0.1.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2572 msiexec.exe

pid	process
2572	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

IEXPLORE.EXEtwtiuWMTMVYtAYTeUctRIfaDFjggmo.exeXiuXiu_360Setup_4.0.1.exejyPHAcnkRKeV.exemtkkDownload.exeKanKan.exeKanKanST.exeKanKanPDF_Setup.exeMtHuaBao.exetwtiuWMTMVYtAYTeUctRIfaDFjggmo.exeKKSetup_1008.exexiuxiu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XiuXiu_360Setup_4.0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jyPHAcnkRKeV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mtkkDownload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKanST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKanPDF_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MtHuaBao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KKSetup_1008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xiuxiu.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

300 cmd.exe
2416 PING.EXE

pid	process
300	cmd.exe
2416	PING.EXE

NSIS installer 5 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\KKSetup_1008.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\KKSetup_1008.exe	nsis_installer_2
\Program Files (x86)\Meitu\KanKan\uninst.exe	nsis_installer_1
\Program Files (x86)\Meitu\KanKan\uninst.exe	nsis_installer_2
\Users\Admin\AppData\Roaming\Meitu\KanKan\mtkkDownload\KanKanPDF_Setup.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

KKSetup_1008.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND	KKSetup_1008.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SECURITYBAND\KanKan.exe = "1"	KKSetup_1008.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD	KKSetup_1008.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\KanKan.exe = "1"	KKSetup_1008.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	KKSetup_1008.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\KanKan.exe = "1"	KKSetup_1008.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

iexplore.exeMtHuaBao.exeKanKan.exeKanKanST.exeIEXPLORE.EXEmtkkDownload.exeXiuXiu_360Setup_4.0.1.exexiuxiu.exeDrvInst.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\Flags = "512"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\VerCache = 0086a9a807ccca010086a9a807ccca01000000009093660000000e00e803991200000e000000991209040000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2EF0F942-226E-4744-BED8-C1AFAABCDFFF}\d2-91-88-a7-e9-5d	MtHuaBao.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2EF0F942-226E-4744-BED8-C1AFAABCDFFF}\WpadNetworkName = "Network 3"	MtHuaBao.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JPEG\shell\ = "open"	KanKan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.PCX\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\KanKan\\ImgFmt.dll,-107"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-91-88-a7-e9-5d\WpadDecisionTime = 300ac5c89e39db01	KanKanST.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-91-88-a7-e9-5d\WpadDecisionTime = 305ab5009f39db01	MtHuaBao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JPEG\DefaultIcon	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.GIF\shell	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\.TGA	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\.JPEG	KanKan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.ICO\shell\open\ = "美图看看"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JPEG\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\KanKan\\ImgFmt.dll,-101"	KanKan.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2EF0F942-226E-4744-BED8-C1AFAABCDFFF}\WpadDecisionReason = "1"	mtkkDownload.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = 010000000000000010229ccc9e39db01	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.TGA\ = "KK.TGA"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications	KanKanST.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "4"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.WMF\DefaultIcon	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.PGX\shell	KanKan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.PSD\shell\ = "open"	KanKan.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mtkkDownload.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.TGA\shell	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2EF0F942-226E-4744-BED8-C1AFAABCDFFF}\WpadDecision = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time = e8070b000100120009002f0009003702	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JPC\shell\ = "open"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.PGX\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\KanKan\\ImgFmt.dll,-112"	KanKan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.CR2\ = "KK.RAW"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	xiuxiu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JPEG\ = "Kankan JPEG 图像"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JPEG\shell\使用美图秀秀编辑和美化	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.JP2\shell\open\command	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2EF0F942-226E-4744-BED8-C1AFAABCDFFF}\d2-91-88-a7-e9-5d	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Type = "3"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.RAW\shell	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.PCX\DefaultIcon	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\KK.WMF\shell\print\command	KanKan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.PPM\ = "KK.PNM"	KanKan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.DNG\ = "KK.RAW"	KanKan.exe

Modifies registry class 64 IoCs

Processes:

XiuXiu_360Setup_4.0.1.exeKanKan.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mtst\Shell\open\command\ = "\"C:\\Program Files (x86)\\Meitu\\XiuXiu\\XiuXiu.exe\" \"%1\""	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Paint.Picture\shell\使用美图秀秀编辑和美化\command	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mtpt\DefaultIcon	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.JPE\OpenWithProgids\KK.JPEG	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PGX	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpegfile\shell\使用美图秀秀编辑和美化	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CR2\OpenWithProgids\KK.RAW	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PSD\OpenWithProgids\KK.PSD	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mtdt\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\XiuXiu\\Images\\Icons\\mtdt_16x16.ico,0"	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KK.skin\shell\open\command\ = "\"C:\\Program Files (x86)\\Meitu\\KanKan\\KanKan.exe\" \"%1\""	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.JPG\OpenWithProgids\KK.JPEG	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.JNG\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.SKA\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PPM	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mtst\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\XiuXiu\\Images\\Icons\\mtst_16x16.ico,0"	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mtpt\Shell\open\command\ = "\"C:\\Program Files (x86)\\Meitu\\XiuXiu\\XiuXiu.exe\" \"%1\""	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.JFI\OpenWithProgids\KK.JPEG	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PNG\OpenWithProgids\KK.PNG	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.JPC\OpenWithProgids\KK.JPC	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\nlf2\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\XiuXiu\\Images\\Icons\\mtnlf2_16X16.ico,0"	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\nlf2\Shell	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpegfile\shell	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.JPG\OpenWithProgids	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.SKA\OpenWithProgids\KK.SKA	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mtww\DefaultIcon\ = "C:\\Program Files (x86)\\Meitu\\XiuXiu\\Images\\Icons\\mtww_16x16.ico,0"	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.MRW\OpenWithProgids\KK.RAW	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PTX	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.DNG\OpenWithProgids\KK.RAW	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.TGA	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PGX\OpenWithProgids\KK.PGX	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RAS	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.MNG\OpenWithProgids\KK.MNG	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.JNG\OpenWithProgids\KK.MNG	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kks	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PGM\OpenWithProgids\KK.PNM	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ARW\OpenWithProgids\KK.RAW	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.KDC\OpenWithProgids\KK.RAW	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5948C0487838E034B936BD7F41486748	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mtjt	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\nlf	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.BMP\OpenWithProgids	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mtjt\ = "MTJT"	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mtbk\Shell	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlf2	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PNG\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.JP2\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RAF	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mtjt	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\nlf3\Shell\open\command	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mtdt	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mtdt\Shell	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KK.skin	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\neoframe\DefaultIcon	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\nlf\Shell\open	XiuXiu_360Setup_4.0.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PCX\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PNM	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.SR2\OpenWithProgids\KK.RAW	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.NEF\OpenWithProgids\KK.RAW	KanKan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88B26C234A892F14A94EAE662952A65E\PackageCode = "3FE7E62EFE9837F46AC519E336724A06"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\nlf2\DefaultIcon	XiuXiu_360Setup_4.0.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kks\ = "KK.skin"	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.SRF\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CUR\OpenWithProgids	KanKan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.WBM	KanKan.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2416 PING.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

Processes:

twtiuWMTMVYtAYTeUctRIfaDFjggmo.exetwtiuWMTMVYtAYTeUctRIfaDFjggmo.exe

pid process

1568 twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
1576 twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe

pid	process
2416	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exepowershell.exejyPHAcnkRKeV.exeKKSetup_1008.exe

pid	process
1488	msiexec.exe
1488	msiexec.exe
800	powershell.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
2676	jyPHAcnkRKeV.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe
1584	KKSetup_1008.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exepowershell.exetwtiuWMTMVYtAYTeUctRIfaDFjggmo.exetwtiuWMTMVYtAYTeUctRIfaDFjggmo.exe

description	pid	process
Token: SeShutdownPrivilege	2572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	1488	msiexec.exe
Token: SeTakeOwnershipPrivilege	1488	msiexec.exe
Token: SeSecurityPrivilege	1488	msiexec.exe
Token: SeCreateTokenPrivilege	2572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2572	msiexec.exe
Token: SeLockMemoryPrivilege	2572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2572	msiexec.exe
Token: SeMachineAccountPrivilege	2572	msiexec.exe
Token: SeTcbPrivilege	2572	msiexec.exe
Token: SeSecurityPrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeLoadDriverPrivilege	2572	msiexec.exe
Token: SeSystemProfilePrivilege	2572	msiexec.exe
Token: SeSystemtimePrivilege	2572	msiexec.exe
Token: SeProfSingleProcessPrivilege	2572	msiexec.exe
Token: SeIncBasePriorityPrivilege	2572	msiexec.exe
Token: SeCreatePagefilePrivilege	2572	msiexec.exe
Token: SeCreatePermanentPrivilege	2572	msiexec.exe
Token: SeBackupPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeShutdownPrivilege	2572	msiexec.exe
Token: SeDebugPrivilege	2572	msiexec.exe
Token: SeAuditPrivilege	2572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2572	msiexec.exe
Token: SeChangeNotifyPrivilege	2572	msiexec.exe
Token: SeRemoteShutdownPrivilege	2572	msiexec.exe
Token: SeUndockPrivilege	2572	msiexec.exe
Token: SeSyncAgentPrivilege	2572	msiexec.exe
Token: SeEnableDelegationPrivilege	2572	msiexec.exe
Token: SeManageVolumePrivilege	2572	msiexec.exe
Token: SeImpersonatePrivilege	2572	msiexec.exe
Token: SeCreateGlobalPrivilege	2572	msiexec.exe
Token: SeBackupPrivilege	2196	vssvc.exe
Token: SeRestorePrivilege	2196	vssvc.exe
Token: SeAuditPrivilege	2196	vssvc.exe
Token: SeBackupPrivilege	1488	msiexec.exe
Token: SeRestorePrivilege	1488	msiexec.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeLoadDriverPrivilege	2812	DrvInst.exe
Token: SeLoadDriverPrivilege	2812	DrvInst.exe
Token: SeLoadDriverPrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	1488	msiexec.exe
Token: SeTakeOwnershipPrivilege	1488	msiexec.exe
Token: SeRestorePrivilege	1488	msiexec.exe
Token: SeTakeOwnershipPrivilege	1488	msiexec.exe
Token: SeRestorePrivilege	1488	msiexec.exe
Token: SeTakeOwnershipPrivilege	1488	msiexec.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeRestorePrivilege	1568	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: 35	1568	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: SeSecurityPrivilege	1568	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: SeSecurityPrivilege	1568	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: SeRestorePrivilege	1576	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: 35	1576	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: SeSecurityPrivilege	1576	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
Token: SeSecurityPrivilege	1576	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msiexec.exeiexplore.exexiuxiu.exe

pid process

2572 msiexec.exe
2572 msiexec.exe
1740 iexplore.exe
1916 xiuxiu.exe
1916 xiuxiu.exe
1916 xiuxiu.exe
1916 xiuxiu.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

xiuxiu.exe

pid process

1916 xiuxiu.exe
1916 xiuxiu.exe
1916 xiuxiu.exe
1916 xiuxiu.exe

pid	process
2572	msiexec.exe
2572	msiexec.exe
1740	iexplore.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe

pid	process
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Processes:

mtkkDownload.exeKanKan.exeKanKanST.exeiexplore.exexiuxiu.exeIEXPLORE.EXEMtHuaBao.exe

pid	process
528	mtkkDownload.exe
528	mtkkDownload.exe
1296	KanKan.exe
2028	KanKanST.exe
2028	KanKanST.exe
1740	iexplore.exe
1740	iexplore.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1916	xiuxiu.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1916	xiuxiu.exe
920	MtHuaBao.exe
920	MtHuaBao.exe
920	MtHuaBao.exe
920	MtHuaBao.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.execmd.exeXiuXiu_360Setup_4.0.1.exeKKSetup_1008.exeKanKan.exemtkkDownload.exe

description	pid	process	target process
PID 1488 wrote to memory of 2300	1488	msiexec.exe	MsiExec.exe
PID 1488 wrote to memory of 2300	1488	msiexec.exe	MsiExec.exe
PID 1488 wrote to memory of 2300	1488	msiexec.exe	MsiExec.exe
PID 1488 wrote to memory of 2300	1488	msiexec.exe	MsiExec.exe
PID 1488 wrote to memory of 2300	1488	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 800	2300	MsiExec.exe	powershell.exe
PID 2300 wrote to memory of 800	2300	MsiExec.exe	powershell.exe
PID 2300 wrote to memory of 800	2300	MsiExec.exe	powershell.exe
PID 2300 wrote to memory of 300	2300	MsiExec.exe	cmd.exe
PID 2300 wrote to memory of 300	2300	MsiExec.exe	cmd.exe
PID 2300 wrote to memory of 300	2300	MsiExec.exe	cmd.exe
PID 300 wrote to memory of 1568	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 1568	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 1568	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 1568	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 2416	300	cmd.exe	PING.EXE
PID 300 wrote to memory of 2416	300	cmd.exe	PING.EXE
PID 300 wrote to memory of 2416	300	cmd.exe	PING.EXE
PID 300 wrote to memory of 1576	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 1576	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 1576	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 300 wrote to memory of 1576	300	cmd.exe	twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
PID 2300 wrote to memory of 2676	2300	MsiExec.exe	jyPHAcnkRKeV.exe
PID 2300 wrote to memory of 2676	2300	MsiExec.exe	jyPHAcnkRKeV.exe
PID 2300 wrote to memory of 2676	2300	MsiExec.exe	jyPHAcnkRKeV.exe
PID 2300 wrote to memory of 2676	2300	MsiExec.exe	jyPHAcnkRKeV.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 2300 wrote to memory of 1108	2300	MsiExec.exe	XiuXiu_360Setup_4.0.1.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1108 wrote to memory of 1584	1108	XiuXiu_360Setup_4.0.1.exe	KKSetup_1008.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 1296	1584	KKSetup_1008.exe	KanKan.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1584 wrote to memory of 528	1584	KKSetup_1008.exe	mtkkDownload.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 1296 wrote to memory of 2028	1296	KanKan.exe	KanKanST.exe
PID 528 wrote to memory of 2732	528	mtkkDownload.exe	KanKanPDF_Setup.exe
PID 528 wrote to memory of 2732	528	mtkkDownload.exe	KanKanPDF_Setup.exe
PID 528 wrote to memory of 2732	528	mtkkDownload.exe	KanKanPDF_Setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XiuXiu_aam-X64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 89A5D7811CD01BB1D94DF42715BB8674 M Global\MSI0000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DeliverZealousOrganizer','C:\Program Files','C:\Program Files'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe" x "C:\Program Files\DeliverZealousOrganizer\ZwBOUOWNBGvtCMZycNirmuYkVxRBKO" -o"C:\Program Files\DeliverZealousOrganizer\" -p"997173P:Vt]7}%8!6a+u" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe" x "C:\Program Files\DeliverZealousOrganizer\TmqervRMoMJhXYcsvItByQcGNQmuHu" -x!1_jyPHAcnkRKeV.exe -x!sss -x!1_AHsWmFUtsdcfXwklmBBALPyTMxykDh.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\DeliverZealousOrganizer\" -p"5651233n+24@Dcz?!m_F" -y
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:300
  - - C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
      "C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe" x "C:\Program Files\DeliverZealousOrganizer\ZwBOUOWNBGvtCMZycNirmuYkVxRBKO" -o"C:\Program Files\DeliverZealousOrganizer\" -p"997173P:Vt]7}%8!6a+u" -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:1568
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2416
  - - C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe
      "C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe" x "C:\Program Files\DeliverZealousOrganizer\TmqervRMoMJhXYcsvItByQcGNQmuHu" -x!1_jyPHAcnkRKeV.exe -x!sss -x!1_AHsWmFUtsdcfXwklmBBALPyTMxykDh.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\DeliverZealousOrganizer\" -p"5651233n+24@Dcz?!m_F" -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:1576
- - C:\Program Files\DeliverZealousOrganizer\jyPHAcnkRKeV.exe
    "C:\Program Files\DeliverZealousOrganizer\jyPHAcnkRKeV.exe" -number 192 -file file3 -mode mode3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- - C:\Program Files\DeliverZealousOrganizer\XiuXiu_360Setup_4.0.1.exe
    "C:\Program Files\DeliverZealousOrganizer\XiuXiu_360Setup_4.0.1.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\KKSetup_1008.exe
      C:\Users\Admin\AppData\Local\Temp\KKSetup_1008.exe /S /K /D=C:\Program Files (x86)\Meitu\
      4⤵
      Modifies firewall policy service
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Program Files (x86)\Meitu\KanKan\KanKan.exe
        
        "C:\Program Files (x86)\Meitu\KanKan\KanKan.exe" -Install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1296
      - C:\Program Files (x86)\Meitu\KanKan\KanKanST.exe
        
        "C:\Program Files (x86)\Meitu\KanKan\KanKanST.exe" <software>MTKK</software><style>0</style><wparam></wparam>
        6⤵
        Writes to the Master Boot Record (MBR)
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        
        PID:2028
    - - C:\Program Files (x86)\Meitu\KanKan\mtkkDownload\mtkkDownload.exe
        
        "C:\Program Files (x86)\Meitu\KanKan\mtkkDownload\mtkkDownload.exe" "http://kankan.dl.meitu.com/update/KanKanPDF_Setup.exe|SW_HIDE|C:\Program Files (x86)\Meitu\KanKan\mtkkDownload\pdf_dl_head.bmp|ÃÀÍ¼¿´¿´PDFÔÄ¶ÁÆ÷|KanKanPDF_Setup"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:528
      - C:\Users\Admin\AppData\Roaming\Meitu\KanKan\mtkkDownload\KanKanPDF_Setup.exe
        
        "C:\Users\Admin\AppData\Roaming\Meitu\KanKan\mtkkDownload\KanKanPDF_Setup.exe"
        6⤵
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2732
  - - C:\Program Files (x86)\Meitu\XiuXiu\xiuxiu.exe
      "C:\Program Files (x86)\Meitu\XiuXiu\xiuxiu.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Program Files (x86)\Meitu\XiuXiu\MtHuaBao.exe
        
        "C:\Program Files (x86)\Meitu\XiuXiu\MtHuaBao.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        
        PID:920
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xiuxiu.meitu.com/success.html?code=2E75AF03F05058A80338EEC7671D8C6B6BD079DE09B757B3895DF24E1D3F8F9C4
      4⤵
      Drops desktop.ini file(s)
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1740
    - - C:\Windows\System32\ie4uinit.exe
        
        "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
        5⤵
        
        PID:2816
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
        5⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        
        PID:1716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003EC" "00000000000005B0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f771d24.rbs

Filesize
7KB

MD5
fe86a34a5029dc654aace54906fc69ee

SHA1
b3a3f7e53c17767835aa4b0f9830b7719dfc69b2

SHA256
7bdc7b99a815c45924799f3e36aa411aeeb1c1f586550b188f51d62f647ea6ba

SHA512
269255222a2ed13058c1900641b19497ba6600fd89549c3c3983e7b917e9ca3aeaa80d2d67da0fffb29c939120072224e8a3bebfb85c63a86cda49da82986198

Download Submit
C:\Program Files (x86)\Meitu\KanKan\KanKanST.exe

Filesize
117KB

MD5
bfeb11a7f3d06750f3fb8e63ee20d2b1

SHA1
130c9f07bc35cddcc5b2512da8fb57beee4ea4c2

SHA256
e506ffc471babad45008a9a84c67742e2df1de86d1f04685a002f3124a18cb4f

SHA512
deb46cd2fd04bf3b3fdc4237216372ce1eaa7fc1608fd1a6ef041e385ef67163efa8c9cfe9f9f39261b6c69b04a1bb5641c93608c19261e78df025e44d25a2ea

Download Submit
C:\Program Files (x86)\Meitu\KanKan\LibImage19.dll

Filesize
481KB

MD5
07723f56376edadc4eaefc6180779144

SHA1
9be4aca6e6615d6db82b5d624cac4cb16dbf0b68

SHA256
f9fe7f1007b0a074b3b38764dd56ca670cf4f3185991691e58a68fe6bcf444d9

SHA512
53542fc068b57b085f042d3581747315020bb4ed30d40af575c85c02749fb812de2e7d966aecb96d051cf7e4547609049f08cb10bd52d0fcdb2af80911f5092b

Download Submit
C:\Program Files (x86)\Meitu\KanKan\MeituUDUI.dll

Filesize
110KB

MD5
8e553252581158a85b2bb0c1b6bc0d3d

SHA1
193998d5662811fe6da7835d79b3ba339d147708

SHA256
40e2535f7e8ee656ea3c0bc88a1853086f152835c5e8f5dc05cd06843bc83f03

SHA512
181964959cc0bf0a4cbe4560441bd0dcca7ff38d31d02a69969b842f91256661cfe8d6941d444b3773395f89a89708b7b3ba8df40681c35dd7f8e30b2c238672

Download Submit
C:\Program Files (x86)\Meitu\KanKan\PlugIns\KanKanPDF\KanKanPDF.exe

Filesize
1.6MB

MD5
778c69b5d6bd84ad731861496e8b976a

SHA1
4a4d6f67ad6b92f62f7e396651933225cc4ea428

SHA256
d6456fdc1f879ffd5d951c6ab11cba47d4b6c7836dd2fc1c0e6b4a3c301ad344

SHA512
fa310b4248d62a4a06bea92e120051f810782a7ebe7b4cc42c89986258e7f8d46ca3dd72c1df02e799879573c0389fe28f5ad7011af44bfad3d569059847f870

Download Submit
C:\Program Files (x86)\Meitu\KanKan\mtkkDownload\pdf_dl_head.bmp

Filesize
85KB

MD5
b9ec1bdc76fac4960a34438143612b58

SHA1
9413dec247a4785e44851b068728cb156f5676a7

SHA256
2956f7246572ad58a9a15424d1111911c1c67aae881f28e646b472b456833e24

SHA512
c49ea1e95aeebd8daf178565aad530c823be773dd315dddb3d4e6c62cbf078f5042d76918e683299a9c3da3cb7621733bbc3d4cc4ad24a63ca6b5d33040e69c9

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Config.ini

Filesize
346B

MD5
87da1aacfdfe95f5bf9c1f751e7b99d3

SHA1
d236fff5356aa9d8fe41fcd99aff1cd913b60e19

SHA256
025453659453d60b7848d0ac4b18938f6eb614b84990d139bb05d773688ddd4e

SHA512
d934106c15746fd77bd8104f35c18bbcb2b56f5ef759ff01f684511c2ea563d72298abcedbd1bd43ee2c39055e289222d8e253436cfd93fa4f7cd6d4c00efe33

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Config.ini

Filesize
346B

MD5
9e3aa783ff2fd5ee6dc5730a86ba1a37

SHA1
3b9d9c80cd50f86b946d48d4e161daafbd343136

SHA256
9d818a4701651af764926f2dd4220b70d92af1393d1fc8a5d4e97df60dac7f03

SHA512
5a4d369d17d8bba9cfa00ab728b9607710134eb02c67746e945f07d3bd40f4d1c9c8ff599668c68aa69516ead5e1044a0341ba7ef63ed22af11adb3eb2207b08

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Config.ini

Filesize
448B

MD5
909971cd166b262f28372eaf5ccb3c23

SHA1
c122511a69a119164ec3eaeb167d416a590c47bf

SHA256
e7de9c57a6a678be4a3233433d2a35fdf0698ff200ede710981a3b09652f4187

SHA512
aba808ac7777309d466d898b216f7b0585a20fff54400b84f6e3cf189211c058576484961dfb8b03497d0efd3fb8225214b76bc91f0d56b77f159d61706deb53

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Config.ini

Filesize
472B

MD5
2d9375466e5a63a3fda6754a3b354507

SHA1
e17c11168aea97c143e7607fac2d67bf6849b212

SHA256
9569bb54ff5b9f32efc403bd8e405ae130a24d5e0be171bf58a5cd633b14cdeb

SHA512
efa95a2eccbb6307fbed00f9a6b0f093bdcbb6c2f79d3aab1761b4e484c17516440cee37f0bf4fa8b8fd5ab624920f4197af3d742823182c939f1e8ac3e1da27

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Images\Icons\mtpt_16x16.ico

Filesize
14KB

MD5
4cf2515afe0c0e391704ab2be82cfae4

SHA1
4e09f5fd32791a54a66962803975f451b9b86da3

SHA256
2975919f27904a5eb73a8eea404793b78a14ced350697b631264f57e5d7faae6

SHA512
ba7dab36991cb2cf4194bcf7ebb6b92b3d792505c082d16aea78ca83aa2466fd652c183334e65f32ad57e0e5c4c5a74b70aaed253e6d280a12f325460cebbb2c

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Resources\RecentFiles.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_color_all_a.png

Filesize
1KB

MD5
2b305b852a5fb2b7560ec67a57e317dc

SHA1
da0d8c347482b0e3680c695226955445e1ddbd80

SHA256
0748cbd259ddd788e0b441d9389f5c5b5ba32f7ba48ee1d4ca9bc2972cf06d55

SHA512
c6f01beba5da5a53b766f25033c3aa138ee5bfbcaad4cc771595c16949bd5b3f6e14f7a22bce1c996d84ce49b8fda3e187fb8ffb08a37d5106514cfb4232a832

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_dlg_restart_b.png

Filesize
1KB

MD5
665f931a7b46ef178e5e7aa0cc0a012f

SHA1
99570a989d750810757326f8a5207fac0abe44de

SHA256
d926eab773d19b7e7ea592f2b824053591242977d7a6aeda1492ff4dfa7caf45

SHA512
6d0d38c84249321cd72f10cb9c1aa7c1b0af2052c257da211a5117ae98ea4fdcb79893f7e0d0b42c7fbb9b708a86806aa372b022c1167dc15e15e9b4d66bb7d5

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_dlg_tab_b.png

Filesize
2KB

MD5
84a28feb8e909643d4a85bd9b5e2b46c

SHA1
108770da9ddefbc253b5bf794d3af75dd048eb78

SHA256
25dd1aae0fdf32ec30d4734e47715b2c9ad03fd3e5bc75f94e4d5f640a027831

SHA512
8ee9ba0a86e7f85e104d9c384d164df018eb97f64e9fd8f4dc90e2f930384928cc7dc9658a461b0b9e5e26a505394ea3bfce8b48e9030ad23e85075daa11cc57

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_main_cut_b.png

Filesize
1KB

MD5
015d3be58a08142679edd14943dce460

SHA1
1c0bcf40b02a043c8d1744e1507424086345982a

SHA256
df54fddf4cded398c109cf6a6050dcbafe55f50876f4f27160cb6bd016f13cbb

SHA512
d2377da0d057f5f90cb78381fe90cb174bfa29d3d7a778bc3bac561912dd1a30c5885397f4bb081aeb3d5d24a5490ac30ddfc222dcf94e83b1a43d1dba147b08

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_main_information_b.png

Filesize
1KB

MD5
d3d94c7695e3970489be29065a71385a

SHA1
da67f4149e6be2263bc861fe40b3209dec22582f

SHA256
dd11dda8950c17975b44433d38e27fbfdafe5dca27eb5f43404927dc0d3f2483

SHA512
c19eb576393f27c7b7c2b1dab1c5e64496ff849ea104b4562d6e95265e4f26acf7338acac840df760a1b9a9cb9298a556f4246a07cd34a01ae5b5a556c2c9879

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\btn_tabmid_flow_c .png

Filesize
2KB

MD5
0f2618b430d0a6c665fce738d34d3d1e

SHA1
a3737dbb2d222be90820eb7eed3d352c3c750a4f

SHA256
66dff6cf801528d7e6488d377a6feabbb80fb1499c81332c4c643911e96f0e1d

SHA512
32a60e55afffb34b77d9e8cd32c91c368e2a05c132be1a16a28d8a228ea9f191c6cadb339bcc4ca64a2c53e8ee411eefd7456e1a28f7f7b817e61b4f224051d3

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\skin_editdlg_left.png

Filesize
999B

MD5
547e49a766811f66825c012a02002015

SHA1
f8f3dce9351a9a2c6691927334877c44a7c7fff2

SHA256
8e079bbf5af2b66416d807b6e81af7d6d947bf5176c56885cc8c12028735e2f1

SHA512
f90a9f24d6330cc2fba62bc341a263f47bf75880dee5de4115c0fc544db7010b1db74904c9aab78c19a7719256c196ca553cc41be3cc0d182f9a88994c4d2aec

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\Skins\red\Images\skin_floatdlg_middleleft.png

Filesize
2KB

MD5
5a11d7c98ed9e0e6a183cd08e0277357

SHA1
9c48fb1e4aca2ab7d79ae456ceda557c6061610a

SHA256
9ccc6ebb78c522b3b525b550933577f407b5eeb6aa05b861faf2fbe48512c905

SHA512
2adf2a57743aa75b4712dd0915f952e48cf225cb5527a1f14d0697630a700ea22aa421f715a1e503ecaed36b863b61d4f80720f0aab05f66c62d7a3c0ae4dc99

Download Submit
C:\Program Files (x86)\Meitu\XiuXiu\XiuXiu.exe

Filesize
8.7MB

MD5
9a935669eb071b5ef198d71ce072efc0

SHA1
085259a93d615604db2ad6178b24c35e4e34c67f

SHA256
4fa3e4a41c3f0ee36b1cac3f6d7b8ee0a54755b5eff28183784d2b630328f982

SHA512
9426222797b08c399289fa86d5817ba27756b051d715fe0d7bbb2ce9358d11f50ef29f98c5292473acf4dbc0c4ab4d085ce3c4e66aaa6e3daf25903186ce086d

Download Submit
C:\Program Files\DeliverZealousOrganizer\2_jyPHAcnkRKeV.exe

Filesize
2.1MB

MD5
1dbac51bdc31b8cfabad114632c79387

SHA1
5b12034a85babb663e77aecd4f9281cbf9eda8b5

SHA256
afe4508718d079d7f304107ebd44499fd203f4efafa1ac47180021a39602ad28

SHA512
6ed9d5e50c2b59ab4c1305d02f258dbdf219484743d7e6efb475ca1d2dc2ed8e5bd92f0e3c6e268a06cb40f1030b842761066fcf45a6da4a253905a4028f6ea3

Download Submit
C:\Program Files\DeliverZealousOrganizer\TmqervRMoMJhXYcsvItByQcGNQmuHu

Filesize
1.5MB

MD5
ed74094421da665fbfd4412225e69346

SHA1
e2f83ce3bb85e6af4629fb2c9513355c9f73e0be

SHA256
55d85c66b199f11061c55d2979bb0cfdba9f0cb664512acc11ee44151303624b

SHA512
5680aabcdb7f120726d83ba870366f5b101404609953c6238c85f302cc980f4e4ee4f7c4c5d82051bb39714f8d36d8ac2c0dc19d5055276d573a370aaa210cdf

Download Submit
C:\Program Files\DeliverZealousOrganizer\XiuXiu_360Setup_4.0.1.exe

Filesize
28.6MB

MD5
d991a77e68513af69324a17c89ef9ec6

SHA1
87d998be8110f12988825daa8fc4e1bd72d4b175

SHA256
e90176f57687096d8605b93770c7f622cb28b96da12e9d837ba7ef4b8b6e419f

SHA512
e909003232a6395f2198d9d401cb8c39cda2837a9d9dd535a0bccc5759f5d49e037041f5814298644c4a742ea2661483868a17fc48ca9c33513a06d6b3757081

Download Submit
C:\Program Files\DeliverZealousOrganizer\ZwBOUOWNBGvtCMZycNirmuYkVxRBKO

Filesize
1.5MB

MD5
a7d3a5214caecf57327e4f269a5f061f

SHA1
874f231cf6a23687103e23b1c06e403861e8bbf0

SHA256
d54ce43a2eeb1e803ab53acb17490bc019fd5e05f6d26140ed5d9af8069061f0

SHA512
7a154f8224ac15fa6dd577e6ee813941483f9d8cb0b9256cf36ebd79412d5294a4af4d55c7cff265f8180a2e205c3d346f6ac50ba248c26dc87c3e006f607840

Download Submit
C:\Program Files\DeliverZealousOrganizer\twtiuWMTMVYtAYTeUctRIfaDFjggmo.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\jquery-1.8.0.min[1].js

Filesize
90KB

MD5
cd8b0bffc85bb5614385ee4ce3596d07

SHA1
359c6c1ed98081b9a69eb3513b9deced59c957f9

SHA256
d73e2e1bff9c55b85284ff287cb20dc29ad9165ec09091a0597b61199f330805

SHA512
00e0cbee27607df41e36c61d4f3badd3d9f3f4020d723863e231c3ef61dc2e2aec89d6c2f2dcfe7687fb81c78e0900fc5ac91eb9115f27d0ac8194c794c88e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD5D8.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD765.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\ioSpecial.ini

Filesize
1KB

MD5
9763d682226b54dd2d2d5e3ecd10a5ee

SHA1
9e018ebda5806469459d14477c8ff7002589048a

SHA256
c209b27b6bc102841854c2b61f516894065094e22b8af327814b55a4c8fca910

SHA512
9e002a18ec73a68f232eb8f5180f25fab86955e41c6e57451ad322c5892d269dd60c890010a635e27358d64b78d8834b0ee4215225c2cfae00d633824f7c2bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\ioSpecial.ini

Filesize
1KB

MD5
03428e7f06b76dfdfabe58309d17f784

SHA1
878bbb89482c6a218b253c9836e9422f1f97e002

SHA256
9712e88d8267975587c31fcca7f4e24f9ff65c8db90da798778e7ad06b1e29b9

SHA512
4cca034dcdadadc7bcc386ececbca6ca14f632222e90c58ad5f26c9092e07ca5742b0f40584e10e7f8963c53d0e5a3026f269caed373ac8627df84f0fffe492b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\ioSpecial.ini

Filesize
1KB

MD5
b7d51d6590edb925f0541d795010a50b

SHA1
e34027b98d288960ee8b098d7e73ff8ce3661d34

SHA256
39a613b9bb7573c99d8efb01d07cbe3cbe178e422d6297f96006336c1dd51c7f

SHA512
498a5d70da483a2786ad19b639a6e353bade20afd07e20ca27709b54e1a1c87b1fff0c62b486b1586e080e3abeadcaa26dd40b9d272b181f57ff468e6dd3c43a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\meituWel.ini

Filesize
436B

MD5
01844cc472856feda4c9a4ef6349ec19

SHA1
c2304d73bfa08ae9e31be42572464ea5083e60db

SHA256
5ffebcd8da81e35915b13a4e875fb9b8ad143c6450d821042678b7e36f7c9c68

SHA512
cc5fbf5bf1f23bae0bfa660de383028d4cda9f04c62396b4b17a63872c12b1107904dfe6501b5fbc139ab43c40d06289937bad4ccbcd03e7a2f7d5ac1f162d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\progress_2.bmp

Filesize
87KB

MD5
77e9a33a1b46088dc9d71bb6b574a2a4

SHA1
8b8dabf1445dd2ae0af77001d7e5810424eed4d7

SHA256
dab5c9ab81a165868685202bebf4e1ead49609c1718f53b60a920331aa60b943

SHA512
3234b163dadb25f084801db876600201897dc3d6bd9ebd215151207cdd9a215f8cc97d30111cdd9a3e4a38de484f29c6a78612e16e34758cbf327972c69a3811

Download Submit
C:\Users\Admin\AppData\Roaming\Meitu\KanKan\Config\config.ini

Filesize
60B

MD5
b43c4c2e11798abda63c545867143b5a

SHA1
961d08437b20ce70dc5761d6db3297bc4e4b1ecd

SHA256
caa83a408faf76cd137b8ab12f9cdf2ad13b1eca26f6f0944a9ec9aeff830b0e

SHA512
24c8faf9139ddc59cc59800dba50a2f3514b7d06f3652141b95836e3c11b8a692d1d7283ef93f3d253aa718e25ccaa8a98cea6ade39f60d18a19dab48ebda641

Download Submit
C:\Windows\Installer\f771d22.msi

Filesize
30.5MB

MD5
4bb380192889a55fb6c183f8053bedd1

SHA1
1016f0c66c398e28416a457d63f5e066edd7bffb

SHA256
34b150091d625d345d47c908841b2570455388c910e78e1403313fce2e5f2ae3

SHA512
00358460e128f3713a1c0ba7d9581bc7592c7bcb42de1d3201bed67a02884a0e31e7a7a672fa85a105736ddd6f4d6033bed85bc56699c1c96f5a1a018805ccb8

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b2b3f8915e223b2e9a7d607c74e793fc

SHA1
b48cfd438a8f88dc747fa6c221f694250d2e0014

SHA256
215f331ac6e73750e680340b3d81d2d20102f75536f8ab0233cfe75996fb813b

SHA512
b83b506fa13f022b7cedf26e1fe0582dbbec9d6d6c8a234e4e0272dc7a2a8ac0b70e9bb98716a8eee2455c7b8df56a433715332572e8efd7dbc40ca29ba53fa1

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
56dbaed19b59e1b1ab855cd342ed23ad

SHA1
b16ff987f750f45f9a786b823ae4f8e6253e2ce4

SHA256
345c976744700232c70fb6467a1262f2135768c86f4058f45163d32d992bbd3b

SHA512
8a86b8d76450f08ef84c4c510997e5c38bb50a829be7a4ef58ede55170047300c5130835938bdd623d5086d1fe7459bcfb125fe35f17dd1731f916bddfcfe786

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\Meitu\KanKan\KanKan.exe

Filesize
4.6MB

MD5
527c5a0b0021723d888c2f4138256f45

SHA1
344d12acba1b81ed23d034e576c063439ac2192d

SHA256
b577edc7b1d338c0ed4488996c2d7af18f52aba9b06b33178ae7dbc7c19b7e7b

SHA512
0754c93e5e84a7e792cbacc19074072a810d7b6f3c35c5c629cf3c34f1cd57ca0a3ab022b502e8d64d79f1a49688263d00a3fcbd13f5740430741d19f133a9be

Download Submit
\Program Files (x86)\Meitu\KanKan\mtkkDownload\mtkkDownload.exe

Filesize
101KB

MD5
f2f3acecc11522414e9364b29d9a9fea

SHA1
968ebc7a3d47050f1f47d97b5ef85c8410d60a3a

SHA256
0335953a89eadae5faa4ef5257d3ea25d396d780f113868c28996f2c6636caa6

SHA512
37dea69b21399954855a727c5049b252bbcc7fcb4a8b8d417606987d91f75b5ccf3beaa90a0113b488ffad061e2f303e623f5c477cf398b000629098f584c10c

Download Submit
\Program Files (x86)\Meitu\KanKan\uninst.exe

Filesize
155KB

MD5
2fdcb8f9b185553997f125330de2e045

SHA1
6e885aa2014efc2de0382719c9fea335389d78cd

SHA256
90de46b752e5bae7e963f09ca6045750dea062625ae87f7d40b7650382f25833

SHA512
da9d1b050a4598bcb2dee71161fb38174e860cb42676ad87d1881610fc13490ceba922420b197c0ef5e09e1fda2d517c5866c23818fac59d23867c2a2ed89479

Download Submit
\Users\Admin\AppData\Local\Temp\KKSetup_1008.exe

Filesize
4.2MB

MD5
b242ab102d9eac948bb306f387fa2700

SHA1
198c188181a090857380182f7aa0518a5bf1e882

SHA256
9bc6d92cf648a975676dc385c9361b91ad18841b4b5b68b1dfd260f4bdf5c10c

SHA512
ef2d3a3de128f783958b3aa39436d85ce6e928ca84cc32413044c547398a708d20eb29d458bb5d3373e6a06a88d186028f095dbaf41f6769f42fe8885b82fc72

Download Submit
\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\AnimGif.dll

Filesize
8KB

MD5
63f11d04d07615bd610c857d0abdbed5

SHA1
fee63014806f8250c3e301a219fc43ef4b3a8f19

SHA256
a1fa2e0191f986824f5fc0ef62aee8b4b25695cc56d4b00fecdc1c92f8ea237f

SHA512
211f3689df9c219507072f71e9795e74cf9dd3a37f32330d8b7cb5cf335b9aec6f874df2e5fabf90e7f3e4d61655f7674d1ca94cd7d7ec4244a153019c334e23

Download Submit
\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\InstallOptions.dll

Filesize
15KB

MD5
89351a0a6a89519c86c5531e20dab9ea

SHA1
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

SHA256
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

SHA512
13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

Download Submit
\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nse3CD4.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
\Users\Admin\AppData\Local\Temp\nso9F7B.tmp\Processes.dll

Filesize
35KB

MD5
2cfba79d485cf441c646dd40d82490fc

SHA1
83e51ac1115a50986ed456bd18729653018b9619

SHA256
86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7

SHA512
cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043

Download Submit
\Users\Admin\AppData\Local\Temp\nso9F7B.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Roaming\Meitu\KanKan\mtkkDownload\KanKanPDF_Setup.exe

Filesize
3.1MB

MD5
324d3657d098174c35079c5c615725f5

SHA1
b36ab315a59d1489b3a7f8caac75a8baa818f023

SHA256
6a7645e8e1dd98f8d11fde9e46499260012535fe1175fd723da7c4790332096e

SHA512
00dd41c61511c990edfaff34ea992411a6aa54bbcbfd91b5837df3510658d32a0756929ad441846033a5ed004adc405f8ce9b803ace1ce05bd067982fe8e41e4

Download Submit
memory/800-18-0x0000000002480000-0x0000000002488000-memory.dmp

Filesize
32KB

Download
memory/800-17-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/1108-4407-0x0000000006490000-0x00000000064B4000-memory.dmp

Filesize
144KB

Download
memory/1584-897-0x0000000000380000-0x000000000038D000-memory.dmp

Filesize
52KB

Download
memory/1916-4447-0x0000000000210000-0x0000000000225000-memory.dmp

Filesize
84KB

Download
memory/1916-4448-0x0000000000230000-0x0000000000241000-memory.dmp

Filesize
68KB

Download
memory/2300-12-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/2676-59-0x000000002B130000-0x000000002B15F000-memory.dmp

Filesize
188KB

Download