Overview

overview

8

Static

static

7

EportClien...57.exe

windows10-2004-x64

EportClien...57.exe

windows11-ltsc_2024-x64

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ox.dll

windows10-2004-x64

3

$PLUGINSDI...ox.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

C:/Program...1.html

windows10-2004-x64

3

C:/Program...1.html

windows11-ltsc_2024-x64

4

C:/Program...r.html

windows10-2004-x64

3

C:/Program...r.html

windows11-ltsc_2024-x64

4

CPUCard_Client.dll

windows10-2004-x64

3

CPUCard_Client.dll

windows11-ltsc_2024-x64

3

CertUpdateApi.dll

windows10-2004-x64

3

CertUpdateApi.dll

windows11-ltsc_2024-x64

3

Check903Reader.dll

windows10-2004-x64

3

Check903Reader.dll

windows11-ltsc_2024-x64

3

CnEport.Pu...er.exe

windows10-2004-x64

3

CnEport.Pu...er.exe

windows11-ltsc_2024-x64

3

CnEport.Pu...ig.dll

windows10-2004-x64

3

CnEport.Pu...ig.dll

windows11-ltsc_2024-x64

3

CnEport.Pu...te.exe

windows10-2004-x64

CnEport.Pu...te.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    108s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    CnEport.Pub.FullUpdate.exe
  • Size 270KB
  • Sample260710-pelansbs9k
  • SHA256 c80a636534d1476e10e09269c492b47790e59f54b43f1af9a83b4a3a922f3d5d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 56 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 20 IoCs
  • Launches sc.exe 11 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 18 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 33 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 17 IoCs
    defense_evasionspywaretrojan
  • Runs .reg file with regedit 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CnEport.Pub.FullUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\CnEport.Pub.FullUpdate.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\AppData\Local\Temp\_Update\EportClientSetup_V1.6.57.exe
      "C:\Users\Admin\AppData\Local\Temp\_Update\EportClientSetup_V1.6.57.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:6080
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe" /codebase "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocket.ActiveX.dll"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5604
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe" "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2420
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe" /S
        3⤵
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3232
      • C:\Windows\drives\HGBOT_x64.exe
        "C:\Windows\drives\HGBOT_x64.exe" -i -s
        3⤵
        • Executes dropped EXE
        PID:1432
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe"
        3⤵
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc stop "WDDrvRpr_Share"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Windows\SysWOW64\sc.exe
            sc stop "WDDrvRpr_Share"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4580
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc delete "WDDrvRpr_Share"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4892
          • C:\Windows\SysWOW64\sc.exe
            sc delete "WDDrvRpr_Share"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:5900
        • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDTokenServerSetup.exe
          "WDTokenServerSetup.exe" /DevFilter=WDK_CCID,watchg2;WDK_UDK,S5BOCL0;WDK_UDK,S5BOCB1;WDK_UDK,S5BOCB1;WDK_UDK,WDCNCB5;
          4⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3788
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c sc stop WDTokenServerHaiGuan
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:900
            • C:\Windows\SysWOW64\sc.exe
              sc stop WDTokenServerHaiGuan
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:2864
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c sc delete WDTokenServerHaiGuan
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1560
            • C:\Windows\SysWOW64\sc.exe
              sc delete WDTokenServerHaiGuan
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:2060
          • C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe
            "C:\Windows\system32\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe" /Service
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:3592
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c sc start WDTokenServerHaiGuan
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5992
            • C:\Windows\SysWOW64\sc.exe
              sc start WDTokenServerHaiGuan
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:5860
        • C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\registCCID.exe
          "C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\registCCID.exe"
          4⤵
          • Executes dropped EXE
          PID:5000
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc config SCardSvr start= auto
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3820
          • C:\Windows\SysWOW64\sc.exe
            sc config SCardSvr start= auto
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:5800
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc start SCardSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Windows\SysWOW64\sc.exe
            sc start SCardSvr
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2812
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc config SCPolicySvc start= auto
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3696
          • C:\Windows\SysWOW64\sc.exe
            sc config SCPolicySvc start= auto
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:468
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc start SCPolicySvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4204
          • C:\Windows\SysWOW64\sc.exe
            sc start SCPolicySvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4856
        • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe
          "C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe" /Service
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4460
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc start "WDDrvRpr_Share"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2328
          • C:\Windows\SysWOW64\sc.exe
            sc start "WDDrvRpr_Share"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:5012
      • C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        "C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe" /install
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2044
      • C:\Windows\SysWOW64\sc.exe
        sc start HDZB_DeviceService_For_CEP_2G
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2420
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Delete /tn CnEportClientComponent /F
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3248
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Delete /tn Eport_iKey_Service /F
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3048
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /create /tn Eport_iKey_Service /sc ONLOGON /TR "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe" /rl HIGHEST /DELAY 0001:10
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3720
      • C:\Windows\SysWOW64\powercfg.exe
        powercfg.exe /H off
        3⤵
        • Power Settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1244
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\SetAccessControl.exe
        F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\SetAccessControl.exe
        3⤵
        • Drops file in Drivers directory
        • Enumerates connected drives
        • Executes dropped EXE
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5168
        • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe
          "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe"
          4⤵
          • Executes dropped EXE
          • Modifies trusted root certificate store through registry
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:3312
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\ePass3003_SimpChinese_gfa.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\ePass3003_SimpChinese_gfa.exe" /S
        3⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:5172
        • C:\Windows\SysWOW64\regedit.exe
          regedit.exe /s "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFACSP11_s.reg"
          4⤵
          • System Location Discovery: System Language Discovery
          • Runs .reg file with regedit
          PID:3772
        • C:\Windows\system32\rundll32.exe
          C:\Windows\system32\rundll32.exe "C:\Windows\system32\GFACSP11.dll",eb_RunNoElevated "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4728
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{c595fba4-dce7-2449-942c-c77363d3566a}\usbccid.inf" "9" "4421fc7e7" "0000000000000198" "WinSta0\Default" "000000000000019C" "208" "f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:5348
  • C:\Windows\drives\HGBOT_x64.exe
    C:\Windows\drives\HGBOT_x64.exe
    1⤵
    • Executes dropped EXE
    PID:1268
  • C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe
    "C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:3340
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -s SCardSvr
    1⤵
      PID:5412
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:1692
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s SCPolicySvc
      1⤵
        PID:4144
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe
        "C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2192
      • C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        1⤵
        • Executes dropped EXE
        PID:5068
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
        1⤵
          PID:2548
        • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe
          "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe"
          1⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Modifies trusted root certificate store through registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5524
        • C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe
          "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4608
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa39ce055 /state1:0x41c64e6d
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:5956
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:3808
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k CameraMonitor
            1⤵
              PID:3920

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  System Services

                  1
                  T1569

                  Service Execution

                  1
                  T1569.002

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Power Settings

                  1
                  T1653

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Impair Defenses

                  1
                  T1562

                  Modify Registry

                  4
                  T1112

                  Subvert Trust Controls

                  2
                  T1553

                  Install Root Certificate

                  2
                  T1553.004

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Service Stop

                  1
                  T1489

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  uninst.exe
                  • Path C:\Program Files (x86)\EnterSafe\ePass3003_GFA\uninst.exe
                  • Size 75KB
                  • SHA256 108caeeedff9e51c8ce3cd0280ef3c203731ea21ba8a2e9f5660411c9f1bbf63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                  • Size 727B
                  • SHA256 a8688726a968e062f5f43637e62d10d744593af3645530b99d426ae9c172d86c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                  • Size 727B
                  • SHA256 c95ed8fde8d66e7f86cc60e710bb43c3363e09f00ac089f9159af14657e3cd9b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                  • Size 727B
                  • SHA256 2a309b134ee2630cd8ac742660570286e0d0349d0181a317abf45a9de8058daf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                  • Size 404B
                  • SHA256 954fa22d81016dd7627fbc8d15f6e613536e7befc638d9cd65848b6fd089edce
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                  • Size 408B
                  • SHA256 9d7228a09c5192ec0e02b91d061cf750927d8bd8afe292d04020df5f32a40636
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                  • Size 412B
                  • SHA256 b0d8ba6b46b1666543006b83818af86078c0c59eb9eae3a874ad45ff97695866
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Tmp1231.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\Tmp1231.tmp
                  • Size 1KB
                  • SHA256 fbe0571254b27a5a65de2bc673f028ca32d173d7ce6f1d8b07082ed3412a45d5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  EportClientSetup_V1.6.57.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\_Update\EportClientSetup_V1.6.57.exe
                  • Size 33.4MB
                  • SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  UserInfo.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsdFB8F.tmp\UserInfo.dll
                  • Size 4KB
                  • SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  nsExec.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsdFB8F.tmp\nsExec.dll
                  • Size 6KB
                  • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsProcessW.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsdFB8F.tmp\nsProcessW.dll
                  • Size 4KB
                  • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  InstallOptions.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\InstallOptions.dll
                  • Size 14KB
                  • SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  KillProcDLL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\KillProcDLL.dll
                  • Size 4KB
                  • SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LangDLL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\LangDLL.dll
                  • Size 5KB
                  • SHA256 fd26ef21d72797fedecd3d15f2001cea793383aceb3cee19a5ae2a3d30e197b6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SimpleSC.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\SimpleSC.dll
                  • Size 49KB
                  • SHA256 b549e39133b32eb4e67e239128c2b55467f01b4601c8147a6c8459d883169fa4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\System.dll
                  • Size 10KB
                  • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ioSpecial.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\ioSpecial.ini
                  • Size 726B
                  • SHA256 e615de7123429a51f15babdfef3c010d16849e74c60862945bd830dde3e355ca
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ioSpecial.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\ioSpecial.ini
                  • Size 590B
                  • SHA256 0ffa7071c60089f9172d9ec5bd7078b4d82e6d323276e95f400759353fc0a5b0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  nsExec.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nss94D6.tmp\nsExec.dll
                  • Size 6KB
                  • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nstFE0F.tmp\System.dll
                  • Size 11KB
                  • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsz17E1.tmp\System.dll
                  • Size 11KB
                  • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  UserInfo.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsz17E1.tmp\UserInfo.dll
                  • Size 4KB
                  • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 65KB
                  • SHA256 3a8b2eb7265ba53e4aa05ad793c5d71bf886f1ed28998688d6b95362e28898d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  usbccid.inf_amd64_1549826200fb969f.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\usbccid.inf_amd64_1549826200fb969f.ini
                  • Size 302B
                  • SHA256 0965aeb58b991f8227f71013598c50183835188cc6975baf305e44adeb57a1bd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  HGBOT_x64.exe
                  • Path C:\Windows\drives\HGBOT_x64.exe
                  • Size 119KB
                  • SHA256 f32defafad6948db40d13b3e5fcde3a8192fa33bd64ff7b77a6c2438c5c46aac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CnEport.Pub.Config.dll
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.Config.dll
                  • Size 18KB
                  • SHA256 0e02f0e4d50e14603fb32b0c1044c47a543016d23054703e59615b41530f417b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CnEport.Pub.WebSocket.ActiveX.dll
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocket.ActiveX.dll
                  • Size 62KB
                  • SHA256 6ed0ea0aba1f6d1fa7398ec2fe5e9fec7c58dc7465189a3528751a030950c100
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CnEport.Pub.WinService.InstallLog
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.InstallLog
                  • Size 338B
                  • SHA256 d7beb2f6fc5d105cde49e0d8da9d2eee4d41048038f78cdd1d92fdf335317be8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CnEport.Pub.WinService.InstallLog
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.InstallLog
                  • Size 843B
                  • SHA256 6fb5fb6c0868f8030e756023f4495d8c13688a2f57ab4482ff5f4fc82a647e09
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CnEport.Pub.WinService.exe
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe
                  • Size 42KB
                  • SHA256 24a5e72a1c1c6d488a2c433e34485e1e70b7cb3656bd289b4b6b3ee7f8e2b3d8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Log1.txt
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\Log1.txt
                  • Size 2KB
                  • SHA256 43423f2d79a2ad2d49503e26881317eeebcff723cdbcd5a5eb0660d3b3f61fe1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Log1.txt
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\Log1.txt
                  • Size 4KB
                  • SHA256 2d478cd01806638b2722f3a75226f2fd568292f0e95997367aa6e9be25833f5c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LogNum.dat
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\LogNum.dat
                  • Size 1B
                  • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
                  • MD5 SHA1 SHA512
                  Submit Download

                  Log1.txt
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\WebSocket\Log1.txt
                  • Size 3KB
                  • SHA256 9cd10b1f0af0a72e61563f151fddba15d26cff29c176c13913144b68993a7e50
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  WinService.xml
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\conf\WinService.xml
                  • Size 1KB
                  • SHA256 3f81cfa937c6378949639616ae261d48de2a71ad69dd61cf4887b398e70fcffb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DPinst64.exe
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe
                  • Size 663KB
                  • SHA256 ec2355c3e59b8d33b21a6ae5041783c45faa22d007384965ffbbfc4195c19853
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Ds20Sign.dll
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\MOFCOM\Ds20Sign.dll
                  • Size 903KB
                  • SHA256 f32c4c945908324613dc7b6b55ae47cb56d429d10eb695a91d5d655e7238d724
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GFACertEnroll.dll
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\MOFCOM\GFACertEnroll.dll
                  • Size 239KB
                  • SHA256 9ae3736703a1ddf417fb326698b87569874dfff5f128563e7a4956700905d02c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  InstallUtil.exe
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe
                  • Size 36KB
                  • SHA256 7f7d33e2e555acc3f6049fbaa6370bd1615af6526bdd47a96bb3a3c5fdf5601b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  RegAsm.exe
                  • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe
                  • Size 60KB
                  • SHA256 7552a38af69c7416a551a74379175c633b5e0f102d8a8f35922d5acf5a49cd08
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  usbccid.cat
                  • Path \??\f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\usbccid.cat
                  • Size 7KB
                  • SHA256 16d27ecd64c18a63005ffc21023b1b426f12d634e4d6d153cdc0668eb8873d2d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  usbccid.inf
                  • Path \??\f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\usbccid.inf
                  • Size 1KB
                  • SHA256 92adf715e8af162170b04bbb238dde9917f5b205800f816c99d23f24203511c2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/3168-20-0x0000000074D40000-0x0000000075361000-memory.dmp
                  Download

                  memory/3168-0-0x0000000001640000-0x0000000001650000-memory.dmp
                  Download

                  memory/3168-1-0x0000000074D42000-0x0000000074D44000-memory.dmp
                  Download

                  memory/3168-22-0x0000000074D40000-0x0000000075361000-memory.dmp
                  Download

                  memory/3168-21-0x0000000074D42000-0x0000000074D44000-memory.dmp
                  Download

                  memory/3168-23-0x0000000074D40000-0x0000000075361000-memory.dmp
                  Download

                  memory/3168-33-0x0000000074D40000-0x0000000075361000-memory.dmp
                  Download

                  memory/3168-19-0x0000000074D40000-0x0000000075361000-memory.dmp
                  Download

                  memory/6080-144-0x0000000074D30000-0x0000000074DCE000-memory.dmp
                  Download

                  memory/6080-348-0x0000000004350000-0x0000000004361000-memory.dmp
                  Download

                  memory/6080-151-0x00000000060D0000-0x00000000060D3000-memory.dmp
                  Download

                  memory/6080-303-0x00000000065B0000-0x0000000006696000-memory.dmp
                  Download

                  memory/6080-139-0x00000000060D0000-0x00000000060D3000-memory.dmp
                  Download

                  memory/6080-44-0x0000000004330000-0x0000000004341000-memory.dmp
                  Download

                  memory/6080-164-0x00000000060D0000-0x00000000060D3000-memory.dmp
                  Download

                  memory/6080-165-0x00000000060D0000-0x00000000060D3000-memory.dmp
                  Download

                  memory/6080-982-0x00000000060D0000-0x00000000060D3000-memory.dmp
                  Download

                  memory/6080-983-0x0000000074D30000-0x0000000074DCE000-memory.dmp
                  Download