1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08

Analysis

max time kernel
93s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
Size

137KB
MD5

21640f9330847c3ad96d1736bdf66840
SHA1

f8b6673a387641d14b71cd56680326b049f23214
SHA256

1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08
SHA512

cf5b5961e0b9bc0723b71e750f551ca17a5b0c9ab8dad2e42f573c0bf34af81309c95d2ecd9b290427efbf7313caa714f10c804e134f10f5ac42844525b9e752
SSDEEP

3072:11i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU8T:ni/NjO5x0Xg+UGSYnuy3Oai/Nr

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	sys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "file:\\\\C:\\sys.exe"	sys.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sys.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe

Executes dropped EXE 1 IoCs

pid	Process
4240	sys.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	sys.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	sys.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1328	cmd.exe
2772	cmd.exe
3084	cmd.exe
4448	cmd.exe
1656	cmd.exe
4620	cmd.exe
1044	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\sys.exe	attrib.exe
File created	C:\WINDOWS\sys.exe	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
File opened for modification	C:\WINDOWS\sys.exe	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
File created	C:\WINDOWS\sys.exe	sys.exe
File opened for modification	C:\WINDOWS\sys.exe	sys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1008	taskkill.exe
3512	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31155188"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1494921375"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02e8159f463db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c932f2da56062742a2f3659b0fbeefbc000000000200000000001066000000010000200000009ea62152f8b155dc9dd799c798c79588d351fa9d4ddd024e2ff37154e15c0111000000000e8000000002000020000000c903a7ade95c6ac47240c9344b9f4086b781a2f05e50d8460842e17653db7ca72000000079b586796b7edd17db8fb68b3fb6beaeac57d97c3712213e8f4af412a8945951400000003244767f9c023dd8a9fafd636acfdde722debc9cbb9566ff4bfc5e01557efebc871c786352113c9c14508537df48369b40982223e0832385b8de254872ab7d1c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1494921375"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31155188"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c932f2da56062742a2f3659b0fbeefbc00000000020000000000106600000001000020000000dd570e84fa0f162fa9d0ba72a09d21f3cb68333209227305e08ae6308d37c0f7000000000e8000000002000020000000c6f9255c086cd5c98b5e7362205bcff4941db7c0540a2bc0ec3ed93da89049b6200000003a2a1da869f49ea93a1588cd699fe3624919cf11bd4792ec18b40765a95938c04000000031c1b073a4547f2bc396a24bc1f6308239dfc388157eba48ccce0dad0236df9a0ab62ec0d1c1025711816c036b4a66ebc22f94dd7e5cfb0fc85d2fe94ba4fd32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	sys.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1493046491"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a48a59f463db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443342848"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31155188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31155188"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{84863CD6-CFE7-11EF-BDBF-D2BD7E71DA05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1493046491"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	sys.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4240	sys.exe
4240	sys.exe
4240	sys.exe
4240	sys.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4404	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
4240	sys.exe
4404	iexplore.exe
4404	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1008	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	83
PID 2128 wrote to memory of 1008	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	83
PID 2128 wrote to memory of 1008	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	83
PID 2128 wrote to memory of 4240	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	86
PID 2128 wrote to memory of 4240	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	86
PID 2128 wrote to memory of 4240	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	86
PID 2128 wrote to memory of 428	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	87
PID 2128 wrote to memory of 428	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	87
PID 2128 wrote to memory of 428	2128	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	87
PID 4240 wrote to memory of 3512	4240	sys.exe	89
PID 4240 wrote to memory of 3512	4240	sys.exe	89
PID 4240 wrote to memory of 3512	4240	sys.exe	89
PID 4240 wrote to memory of 4404	4240	sys.exe	90
PID 4240 wrote to memory of 4404	4240	sys.exe	90
PID 4404 wrote to memory of 2652	4404	iexplore.exe	92
PID 4404 wrote to memory of 2652	4404	iexplore.exe	92
PID 4404 wrote to memory of 2652	4404	iexplore.exe	92
PID 4240 wrote to memory of 1328	4240	sys.exe	93
PID 4240 wrote to memory of 1328	4240	sys.exe	93
PID 4240 wrote to memory of 1328	4240	sys.exe	93
PID 1328 wrote to memory of 1540	1328	cmd.exe	95
PID 1328 wrote to memory of 1540	1328	cmd.exe	95
PID 1328 wrote to memory of 1540	1328	cmd.exe	95
PID 4240 wrote to memory of 2772	4240	sys.exe	96
PID 4240 wrote to memory of 2772	4240	sys.exe	96
PID 4240 wrote to memory of 2772	4240	sys.exe	96
PID 2772 wrote to memory of 3680	2772	cmd.exe	98
PID 2772 wrote to memory of 3680	2772	cmd.exe	98
PID 2772 wrote to memory of 3680	2772	cmd.exe	98
PID 4240 wrote to memory of 3084	4240	sys.exe	99
PID 4240 wrote to memory of 3084	4240	sys.exe	99
PID 4240 wrote to memory of 3084	4240	sys.exe	99
PID 3084 wrote to memory of 2376	3084	cmd.exe	101
PID 3084 wrote to memory of 2376	3084	cmd.exe	101
PID 3084 wrote to memory of 2376	3084	cmd.exe	101
PID 4240 wrote to memory of 4448	4240	sys.exe	102
PID 4240 wrote to memory of 4448	4240	sys.exe	102
PID 4240 wrote to memory of 4448	4240	sys.exe	102
PID 4448 wrote to memory of 1440	4448	cmd.exe	104
PID 4448 wrote to memory of 1440	4448	cmd.exe	104
PID 4448 wrote to memory of 1440	4448	cmd.exe	104
PID 4240 wrote to memory of 1656	4240	sys.exe	105
PID 4240 wrote to memory of 1656	4240	sys.exe	105
PID 4240 wrote to memory of 1656	4240	sys.exe	105
PID 1656 wrote to memory of 2348	1656	cmd.exe	107
PID 1656 wrote to memory of 2348	1656	cmd.exe	107
PID 1656 wrote to memory of 2348	1656	cmd.exe	107
PID 4240 wrote to memory of 4620	4240	sys.exe	108
PID 4240 wrote to memory of 4620	4240	sys.exe	108
PID 4240 wrote to memory of 4620	4240	sys.exe	108
PID 4620 wrote to memory of 4548	4620	cmd.exe	110
PID 4620 wrote to memory of 4548	4620	cmd.exe	110
PID 4620 wrote to memory of 4548	4620	cmd.exe	110
PID 4240 wrote to memory of 1044	4240	sys.exe	111
PID 4240 wrote to memory of 1044	4240	sys.exe	111
PID 4240 wrote to memory of 1044	4240	sys.exe	111
PID 1044 wrote to memory of 4432	1044	cmd.exe	113
PID 1044 wrote to memory of 4432	1044	cmd.exe	113
PID 1044 wrote to memory of 4432	1044	cmd.exe	113

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2348	attrib.exe
4548	attrib.exe
4432	attrib.exe
1540	attrib.exe
3680	attrib.exe
2376	attrib.exe
1440	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
"C:\Users\Admin\AppData\Local\Temp\1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im KSafeTray.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\WINDOWS\sys.exe
  "C:\WINDOWS\sys.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /im KSafeTray.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4404 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\sys.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\WINDOWS\sys.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "c:\sys.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "c:\sys.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del 1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
9bf51918a12f03ca4f26d83e99645740

SHA1
9c83d4a1ee3ee73e734776e29009d37e2273183e

SHA256
c04f101c94199d3b225ad950b34b6a4d7e1d5392e01b01fde11adebfae33aa5e

SHA512
6c8e8ad3940371f69a04f56dfd8da664a2bfbbcf3dcfce35903faeb46d301a38c72fb6f65d812e5018b5dbdf74ee293520fd6a34976e2b98285ad62114b891ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
dfb40d53bed0955ba8d6ba257d6a2381

SHA1
3dafba9593550740594cd18b94ae5a5cf0355156

SHA256
13dedc76f36e27621e4bbc227caff4e1d8025218cb41a5e814181f31d727f82e

SHA512
c9d65396b9cc7246bb9b213e4d6c460b0d1febaa5b466dd3504be41d1e1b28b3a12caff392ed150fcbca8d58ea578443802fe75c93c659fe40709e84b0153aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver4292.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\sys.exe

Filesize
137KB

MD5
2c30064b731f668d015d78b313a10f66

SHA1
b2d886f8fc9409d46f59fc063ef6738943942f0c

SHA256
bddcce4021e17c6f18e0cb5720d41805127b66a07dd7b4dd64051d52c6e4611a

SHA512
d861edbefabb9cf4d879972c258fb6c2a868f8ab8904eef0ee12edf5e0b3dc41550c6cbfe4616a10d360b7ff093c76087d15c235c24717d8d2490fb13ba26eca

Download Submit
\??\c:\sys.exe

Filesize
137KB

MD5
d7fb14c3f560dabf95fa4aac8913f2c4

SHA1
ee61dd97e33d01420e72d33a07c16233a252caf6

SHA256
9b9199b1ebcbc0cdcf58b0830a7decd49de28b1cef8d95e62982fd804130ebed

SHA512
98be947624629966288b2141587b5320599c4af830ca73f4d37f6a82e84cb80b2bf9b7a1f5ecf5574c3e0f415565fa0b416a4c6aa0a4c59cf61d0a70b476994e

Download Submit