96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Size 975KB
Sample260805-ryrynsbf72
SHA256 96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb
MD5 7749a13cbc2164fcc893cb8972fbb463
SHA1 6bd65364152ccd9a23d56e8312a114ce1c1ba785
SHA512 4bce2b491b721354b09cbbfb91c7f9bfbc28ac316e32da8a314f4c658ce701a612af65abb10e63b4e5917045b85db0d4976d96debbd510b7a1e731fc1a5080b3
SSDEEP 24576:EEB1Nre7hfgwOcR3ARvOoXf93KyrYmhGs3:EExe7lgwEbKyrYw3
TLSH
T120257D5A96E001EAC567C179CD675607E776B80A13306BDF0BE24A961F23BE09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence spyware trojan

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zhudongfangyu.exe	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\ca.crt.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
File created	C:\Program Files\YouthNetGuard\ca.key.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Launches sc.exe 40 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1992	sc.exe
4252	sc.exe
3352	sc.exe
2052	sc.exe
4060	sc.exe
720	sc.exe
3020	sc.exe
4928	sc.exe
2184	sc.exe
4716	sc.exe
3184	sc.exe
540	sc.exe
1444	sc.exe
2332	sc.exe
1748	sc.exe
2828	sc.exe
4892	sc.exe
404	sc.exe
780	sc.exe
3536	sc.exe
4516	sc.exe
4784	sc.exe
1604	sc.exe
3760	sc.exe
1340	sc.exe
8	sc.exe
3204	sc.exe
2796	sc.exe
1832	sc.exe
4216	sc.exe
1900	sc.exe
4220	sc.exe
3940	sc.exe
4344	sc.exe
5028	sc.exe
560	sc.exe
1868	sc.exe
3516	sc.exe
2744	sc.exe
4228	sc.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "file:///C:/ProgramData/YngRuntime/yng.pac"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeLoadDriverPrivilege	4752	fltmc.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeLoadDriverPrivilege	2136	fltmc.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeLoadDriverPrivilege	3364	fltmc.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 4752	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	94
PID 1764 wrote to memory of 1900	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	96
PID 1764 wrote to memory of 1604	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	98
PID 1764 wrote to memory of 3184	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	100
PID 1764 wrote to memory of 3760	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	102
PID 1764 wrote to memory of 3352	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	104
PID 1764 wrote to memory of 2744	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	106
PID 1764 wrote to memory of 1340	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	108
PID 1764 wrote to memory of 2052	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	110
PID 1764 wrote to memory of 2136	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	112
PID 1764 wrote to memory of 4060	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	114
PID 1764 wrote to memory of 5028	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	116
PID 1764 wrote to memory of 4220	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	118
PID 1764 wrote to memory of 720	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	120
PID 1764 wrote to memory of 1748	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	122
PID 1764 wrote to memory of 3940	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	124
PID 1764 wrote to memory of 2828	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	126
PID 1764 wrote to memory of 4892	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	128
PID 1764 wrote to memory of 540	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	130
PID 1764 wrote to memory of 404	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	132
PID 1764 wrote to memory of 4228	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	134
PID 1764 wrote to memory of 560	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	136
PID 1764 wrote to memory of 1992	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	138
PID 1764 wrote to memory of 3020	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	140
PID 1764 wrote to memory of 780	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	142
PID 1764 wrote to memory of 4928	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	144
PID 1764 wrote to memory of 3364	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	146
PID 1764 wrote to memory of 8	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	148
PID 1764 wrote to memory of 3204	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	150
PID 1764 wrote to memory of 2184	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	152
PID 1764 wrote to memory of 4716	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	154
PID 1764 wrote to memory of 3536	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	156
PID 1764 wrote to memory of 2796	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	158
PID 1764 wrote to memory of 1868	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	160
PID 1764 wrote to memory of 1444	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	162
PID 1764 wrote to memory of 4516	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	164
PID 1764 wrote to memory of 3516	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	166
PID 1764 wrote to memory of 2332	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	168
PID 1764 wrote to memory of 1832	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	170
PID 1764 wrote to memory of 4344	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	172
PID 1764 wrote to memory of 4784	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	174
PID 1764 wrote to memory of 4216	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	176
PID 1764 wrote to memory of 4252	1764	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	178

C:\Users\Admin\AppData\Local\Temp\96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
"C:\Users\Admin\AppData\Local\Temp\96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:1900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:3184
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:3760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:1340
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:2052
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:4060
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:5028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:4220
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:720
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:3940
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:4892
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:540
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:404
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:560
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:1992
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:3020
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:780
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:4928
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:8
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:3204
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:2184
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:4716
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:3536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:2796
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:1868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:1444
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:3516
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:1832
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:4344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:4784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:4216
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ca.crt.pem

Path C:\ProgramData\YngRuntime\backup\ca.crt.pem
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem

Path C:\ProgramData\YngRuntime\backup\ca.key.pem
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 33B
SHA256 9b27ecfa9b65cc90a87f58ca24bbf434a1e1303ac2c83a60d2a9549c9da6ff68
MD5 74ee66f2a4d82c02909bd5722991f6fe
SHA1 d952d2b723f1ce48c2ed2c5b085fe1cefd7dcf94
SHA512 1ebc7af2f7315445ffc3837f26c03a98a5df368eb092195745b734437c3424aa58a96ce78927a40f1b5e878eb3ad4665872d3f277f65eb912c4ed3eeecf78184
MD5 SHA1 SHA512

Submit Download

parent_unlock.sha256

Path C:\ProgramData\YngRuntime\parent_unlock.sha256
Size 65B
SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
MD5 d2293d580969d3feb6bd82fc44c0deae
SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
TLSH
T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
MD5 SHA1 SHA512 TLSH

Submit Download