96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Size 975KB
Sample260805-ryrynsbf72
SHA256 96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb
MD5 7749a13cbc2164fcc893cb8972fbb463
SHA1 6bd65364152ccd9a23d56e8312a114ce1c1ba785
SHA512 4bce2b491b721354b09cbbfb91c7f9bfbc28ac316e32da8a314f4c658ce701a612af65abb10e63b4e5917045b85db0d4976d96debbd510b7a1e731fc1a5080b3
SSDEEP 24576:EEB1Nre7hfgwOcR3ARvOoXf93KyrYmhGs3:EExe7lgwEbKyrYw3
TLSH
T120257D5A96E001EAC567C179CD675607E776B80A13306BDF0BE24A961F23BE09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence spyware trojan

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zhudongfangyu.exe	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\ca.key.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
File created	C:\Program Files\YouthNetGuard\ca.crt.pem	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
948	sc.exe
1084	sc.exe
6104	sc.exe
6064	sc.exe
4172	sc.exe
5920	sc.exe
1200	sc.exe
4512	sc.exe
5344	sc.exe
6108	sc.exe
5880	sc.exe
5900	sc.exe
2588	sc.exe
3472	sc.exe
5720	sc.exe
1140	sc.exe
1792	sc.exe
5604	sc.exe
4736	sc.exe
256	sc.exe
3380	sc.exe
1136	sc.exe
5532	sc.exe
4420	sc.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "file:///C:/ProgramData/YngRuntime/yng.pac"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeLoadDriverPrivilege	2788	fltmc.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeLoadDriverPrivilege	4772	fltmc.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
Token: SeDebugPrivilege	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 2788	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	90
PID 3656 wrote to memory of 256	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	92
PID 3656 wrote to memory of 1140	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	94
PID 3656 wrote to memory of 6064	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	96
PID 3656 wrote to memory of 4172	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	98
PID 3656 wrote to memory of 3380	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	100
PID 3656 wrote to memory of 1792	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	102
PID 3656 wrote to memory of 1136	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	104
PID 3656 wrote to memory of 5880	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	106
PID 3656 wrote to memory of 4772	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	108
PID 3656 wrote to memory of 5532	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	110
PID 3656 wrote to memory of 5604	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	112
PID 3656 wrote to memory of 5920	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	114
PID 3656 wrote to memory of 1200	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	116
PID 3656 wrote to memory of 5900	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	118
PID 3656 wrote to memory of 4420	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	120
PID 3656 wrote to memory of 4512	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	122
PID 3656 wrote to memory of 2588	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	124
PID 3656 wrote to memory of 948	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	126
PID 3656 wrote to memory of 1084	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	128
PID 3656 wrote to memory of 4736	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	130
PID 3656 wrote to memory of 3472	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	132
PID 3656 wrote to memory of 5344	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	134
PID 3656 wrote to memory of 6104	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	136
PID 3656 wrote to memory of 5720	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	138
PID 3656 wrote to memory of 6108	3656	96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe	140

C:\Users\Admin\AppData\Local\Temp\96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe
"C:\Users\Admin\AppData\Local\Temp\96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:256
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:1140
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:6064
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:4172
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:3380
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:1792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:1136
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:5880
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:5532
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:5604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:5920
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:1200
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:5900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:4420
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:4512
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:1084
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:4736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:3472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:5344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:6104
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  - Launches sc.exe
  PID:5720
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ca.crt.pem

Path C:\ProgramData\YngRuntime\backup\ca.crt.pem
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem

Path C:\ProgramData\YngRuntime\backup\ca.key.pem
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 33B
SHA256 8e5a8234236a4164b1bbcdef3ec21223cbe0d985ba692684f17b4b8797ed5d55
MD5 31e3211b1c145ce4a22802e439fa0b07
SHA1 db2143c7f56cbcb0a10c85acacf43bf299592113
SHA512 a2703084142a73b219a9b571ede05eb4adc30f8488d7753bbd8e0bac5712122e9ccc17af248d9bf34dd9ead475885afe99629eb475f233fa5e8bdc3cfa4b33a8
MD5 SHA1 SHA512

Submit Download

parent_unlock.sha256

Path C:\ProgramData\YngRuntime\parent_unlock.sha256
Size 65B
SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
MD5 d2293d580969d3feb6bd82fc44c0deae
SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
TLSH
T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
MD5 SHA1 SHA512 TLSH

Submit Download