d41d54ed544a80968d0e906ad4a2472719687cd056492320bd38c3d6d13fabb9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat
Size 16KB
Sample260807-wtly3stxev
SHA256 d41d54ed544a80968d0e906ad4a2472719687cd056492320bd38c3d6d13fabb9
MD5 4fed1aaf79239ee91bcbfd5dbbcd0002
SHA1 e3e95bad21cd71dbb3eee48ab7be70ce52746f0c
SHA512 d7e6e5a413c7163b1355fa27ffe910f31256d731b50a47fb5db4c725d32dbe27776b0eaea9eb3690d5fc96296620243fa09b610b3c914d74891a10ac72d60a52
SSDEEP 384:QRqSGzQeF63qwOh4dMEf7tpCO6u630BNy0ICpIQ/xODvNI5hl5p3eVD9sCDJY861:Qyh1O1pnPZ46hhm6sHJQ
TLSH
T10F7293033E0146068D70E6E05F7A4166EB4A8187833791D9306FB2AAB35F34B97ED7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4680	powershell.exe
6	4680	powershell.exe
7	4680	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
4680	powershell.exe
2980	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
1764	regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx	regsvr32.exe
File created	C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
840	powershell.exe
3340	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2236	cmd.exe
5104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4508	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\TruyenThuyetDoLong.exe = "11001"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\TruyenThuyetDoLong.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\TruyenThuyetDoLong.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\TruyenThuyetDoLong.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\TruyenThuyetDoLong.exe = "11001"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\TruyenThuyetDoLong.exe = "0"	reg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfp\ = "MacromediaFlashPaper.MacromediaFlashPaper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\TypeLib\ = "{57A0E746-3863-4D20-A811-950C84F1DB9B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7\ = "Shockwave Flash Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID\ = "ShockwaveFlash.ShockwaveFlash"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\ShockwaveFlash.ShockwaveFlash\CLSID\ = "{D27CDB6E-AE6D-11CF-96B8-444553540000}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer\ = "ShockwaveFlash.ShockwaveFlash.10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-shockwave-flash	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Insertable	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\ShockwaveFlash.ShockwaveFlash\ = "Shockwave Flash Object"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\Content Type = "application/futuresplash"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\ShockwaveFlash.ShockwaveFlash\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.11	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Control	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2324	powershell.exe
2324	powershell.exe
840	powershell.exe
840	powershell.exe
3340	powershell.exe
3340	powershell.exe
2980	powershell.exe
2980	powershell.exe
4680	powershell.exe
4680	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1896	2236	cmd.exe	86
PID 2236 wrote to memory of 2324	2236	cmd.exe	87
PID 2236 wrote to memory of 4508	2236	cmd.exe	88
PID 2236 wrote to memory of 840	2236	cmd.exe	90
PID 2236 wrote to memory of 4736	2236	cmd.exe	91
PID 2236 wrote to memory of 3600	2236	cmd.exe	92
PID 2236 wrote to memory of 3900	2236	cmd.exe	93
PID 2236 wrote to memory of 3340	2236	cmd.exe	94
PID 2236 wrote to memory of 3316	2236	cmd.exe	95
PID 2236 wrote to memory of 4972	2236	cmd.exe	96
PID 2236 wrote to memory of 4576	2236	cmd.exe	97
PID 2236 wrote to memory of 1764	2236	cmd.exe	98
PID 2236 wrote to memory of 5040	2236	cmd.exe	99
PID 2236 wrote to memory of 900	2236	cmd.exe	100
PID 2236 wrote to memory of 3836	2236	cmd.exe	101
PID 2236 wrote to memory of 4968	2236	cmd.exe	102
PID 2236 wrote to memory of 3924	2236	cmd.exe	103
PID 2236 wrote to memory of 4568	2236	cmd.exe	104
PID 2236 wrote to memory of 344	2236	cmd.exe	105
PID 2236 wrote to memory of 220	2236	cmd.exe	106
PID 2236 wrote to memory of 2928	2236	cmd.exe	107
PID 2236 wrote to memory of 2032	2236	cmd.exe	108
PID 2236 wrote to memory of 4300	2236	cmd.exe	109
PID 2236 wrote to memory of 4484	2236	cmd.exe	110
PID 2236 wrote to memory of 3804	2236	cmd.exe	111
PID 2236 wrote to memory of 4004	2236	cmd.exe	112
PID 2236 wrote to memory of 2812	2236	cmd.exe	113
PID 2236 wrote to memory of 4176	2236	cmd.exe	114
PID 2236 wrote to memory of 980	2236	cmd.exe	115
PID 2236 wrote to memory of 2936	2236	cmd.exe	116
PID 2236 wrote to memory of 452	2236	cmd.exe	117
PID 2236 wrote to memory of 1444	2236	cmd.exe	118
PID 2236 wrote to memory of 4580	2236	cmd.exe	119
PID 2236 wrote to memory of 552	2236	cmd.exe	120
PID 2236 wrote to memory of 3156	2236	cmd.exe	121
PID 2236 wrote to memory of 3252	2236	cmd.exe	122
PID 2236 wrote to memory of 2980	2236	cmd.exe	123
PID 2236 wrote to memory of 5104	2236	cmd.exe	124
PID 5104 wrote to memory of 760	5104	cmd.exe	125
PID 5104 wrote to memory of 4016	5104	cmd.exe	126
PID 2236 wrote to memory of 4680	2236	cmd.exe	127

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\LauncherClient\CAI_DAT.bat"
1⤵
- Drops file in System32 directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "if($env:HERE -match '[^\x20-\x7e]'){exit 1}else{exit 0}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\system32\taskkill.exe
  taskkill /IM TruyenThuyetDoLong.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem -LiteralPath $env:HERE -Recurse -Force -ErrorAction SilentlyContinue | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:3600
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" /v Release
  2⤵
  PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -LiteralPath $env:DST -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" /v "Compatibility Flags" /f
  2⤵
  PID:3316
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Security" /v "DisableFlashInIE" /f
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Internet Explorer\Security" /v "DisableFlashInIE" /f
  2⤵
  PID:4576
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1764
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash" /ve /d "Shockwave Flash Object" /f
  2⤵
  - Modifies registry class
  PID:5040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash\CLSID" /ve /d "{D27CDB6E-AE6D-11CF-96B8-444553540000}" /f
  2⤵
  - Modifies registry class
  PID:900
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash\CurVer" /ve /d "ShockwaveFlash.ShockwaveFlash.11" /f
  2⤵
  PID:3836
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash.11" /ve /d "Shockwave Flash Object" /f
  2⤵
  PID:4968
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash.11\CLSID" /ve /d "{D27CDB6E-AE6D-11CF-96B8-444553540000}" /f
  2⤵
  PID:3924
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}" /ve /d "Shockwave Flash Object" /f
  2⤵
  - Modifies registry class
  PID:4568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve /d "C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx" /f
  2⤵
  PID:344
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
  2⤵
  - Modifies registry class
  PID:220
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ProgID" /ve /d "ShockwaveFlash.ShockwaveFlash.11" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\VersionIndependentProgID" /ve /d "ShockwaveFlash.ShockwaveFlash" /f
  2⤵
  - Modifies registry class
  PID:2032
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Control" /ve /d "" /f
  2⤵
  - Modifies registry class
  PID:4300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Insertable" /ve /d "" /f
  2⤵
  - Modifies registry class
  PID:4484
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Version" /ve /d "1.0" /f
  2⤵
  PID:3804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\TypeLib" /ve /d "{D27CDB6B-AE6D-11CF-96B8-444553540000}" /f
  2⤵
  - Modifies registry class
  PID:4004
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}" /f
  2⤵
  - Modifies registry class
  PID:2812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}" /f
  2⤵
  - Modifies registry class
  PID:4176
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 11001 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:2936
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:452
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 11001 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:1444
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:4580
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range_TTDL" /v ":Range" /t REG_SZ /d "180.93.244.31" /f
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range_TTDL" /v "http" /t REG_DWORD /d 2 /f
  2⤵
  PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Add-MpPreference -ExclusionPath $env:HERE.TrimEnd('\') -ErrorAction Stop}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve 2>nul | find "REG_SZ"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve
    3⤵
    PID:760
- - C:\Windows\system32\find.exe
    find "REG_SZ"
    3⤵
    PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ip=$env:SERVER; foreach($p in 81,843,13000){ $c=New-Object System.Net.Sockets.TcpClient; $ok=$false; try{ $a=$c.BeginConnect($ip,$p,$null,$null); if($a.AsyncWaitHandle.WaitOne(4000,$false)){ $c.EndConnect($a); $ok=$c.Connected } }catch{ $ok=$false }; try{$c.Close()}catch{}; if($ok){ Write-Host (' OK cong ' + $p) } else { Write-Host (' [CANH BAO] cong ' + $p + ' khong ket noi duoc') } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 61b4455d8b537fdef049f7b1385e65bc7d95b677ef131c35c4394f1a5da47d31
MD5 e4e2407f091a353b29c5e15c0df6e70a
SHA1 3f442ef692cfae77b79d0ff594a81dfe6b567dff
SHA512 dacca9e106a02ee0334ab4b9c0ad84318d1dd27071118d091a2d28a8617f9fc6dcc8eaae1460934dfc789d8f3182a0a6edb4b1dcedfabd9dff51fd325d13a286
TLSH
T143114523F38C8921CC96163A509DAC5172B586CB81AFDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 06131bf4d4fe55b1f4bbc16d84a994b1b0891d4459bc1c5b05a8cec3725ebb27
MD5 20810d165c316378abc650cfa1e8d26a
SHA1 1e93a79cbb16e8836bc669ecbff8bd614b8fd05b
SHA512 58fc8a24e40ab9051739ee47d99d69a24bf0ec1755a507b13fd76df47395c97a140aa56f1f4de3a0fc848216fc6f32c7e191aa862848c65226eba5c3697aa098
TLSH
T1B121A827B3DC8921CC86163A109D9C1172B683C7809EDF9F6FC0D600A07F598CB31190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a083934c386c9980461f3ce24177e5dd696d7a02db2fa2ea99123a247a104bda
MD5 6e550d7b535bed4feb31f6d7300bbfaa
SHA1 02793b3eef1f37706012797d5cef0b33b27d0a36
SHA512 a954ad4c9250377ab3e0b5596b3076e4340befcdb5e953147d6bf4f9d57deb8372a03612d151d026fd181b4e9ced1653df3803590162a05b116b3d8a14160692
TLSH
T15D117637B39C89A1CC86163A409DAC1172B687C741AEDFDF6BC0C214E1AF994CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 47d73c514b6ba6bea241dac0491ce942cedb7a5fb9621dca3c95ce5511f272f2
MD5 edc94d6cffeec0aa87c5efc4d515f79a
SHA1 8ab843d139d849f5e72008e14013aa1008945e6d
SHA512 0b9505035c2b8a9094647be0836afe701489d5b51ac758d13233c1e563809b219bb4443f2e527503af14573c32d733618dab1a35c8c7b789fbe4d52711572f11
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4xaiek4i.04o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xaiek4i.04o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Flash32_11_4_402_265.ocx

Path C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx
Size 9.2MB
SHA256 f5829c373011d9bcf88e26829dc900eb4faac99b1a07511dc974ffe9080bd1f6
MD5 c7d41058eeb57f425fbd1585f9de71c4
SHA1 88fdd76afdc2a1198103e8f4dd416d54c3ab89d0
SHA512 0492c58a37357d575ee17ce1a63fb07b7bf0b7876aa5d19d6eb5f568f740c50cbbb5af4c1ab686d57116f79dca99c8b9a01aeba704a59d1f2e3495e79dbc5f48
SSDEEP 196608:+0iIptsRKRkW3pti7pCtfmsAq/8iRhOe/zoxKmVGOts2AGeusYOV:+0HptoK/5ts4fmHiRhOeLgKmVGOts2AR
TLSH
T1DBA6CF23A7D1C0B6D09324F15137B76FA9FC6B21077499CBABC05865AA703D1963A38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-22-0x0000023BCAD70000-0x0000023BCAD80000-memory.dmp

Download

memory/840-23-0x0000023BCAD70000-0x0000023BCAD80000-memory.dmp

Download

memory/840-33-0x0000023BE2E00000-0x0000023BE301C000-memory.dmp

Download

memory/2324-8-0x000002584AA40000-0x000002584AA50000-memory.dmp

Download

memory/2324-19-0x000002584AB50000-0x000002584AD6C000-memory.dmp

Download

memory/2324-11-0x000002584AAF0000-0x000002584AB12000-memory.dmp

Download

memory/2324-7-0x000002584AA40000-0x000002584AA50000-memory.dmp

Download