d41d54ed544a80968d0e906ad4a2472719687cd056492320bd38c3d6d13fabb9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat
Size 16KB
Sample260807-wtly3stxev
SHA256 d41d54ed544a80968d0e906ad4a2472719687cd056492320bd38c3d6d13fabb9
MD5 4fed1aaf79239ee91bcbfd5dbbcd0002
SHA1 e3e95bad21cd71dbb3eee48ab7be70ce52746f0c
SHA512 d7e6e5a413c7163b1355fa27ffe910f31256d731b50a47fb5db4c725d32dbe27776b0eaea9eb3690d5fc96296620243fa09b610b3c914d74891a10ac72d60a52
SSDEEP 384:QRqSGzQeF63qwOh4dMEf7tpCO6u630BNy0ICpIQ/xODvNI5hl5p3eVD9sCDJY861:Qyh1O1pnPZ46hhm6sHJQ
TLSH
T10F7293033E0146068D70E6E05F7A4166EB4A8187833791D9306FB2AAB35F34B97ED7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3120	powershell.exe
4	3120	powershell.exe
5	3120	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4628	powershell.exe
4640	powershell.exe
3120	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
4796	regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx	regsvr32.exe
File created	C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4820	powershell.exe
256	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5800	cmd.exe
4156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1472	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\TruyenThuyetDoLong.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\TruyenThuyetDoLong.exe = "11001"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\TruyenThuyetDoLong.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\TruyenThuyetDoLong.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\TruyenThuyetDoLong.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\TruyenThuyetDoLong.exe = "11001"	reg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10\ = "Shockwave Flash Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.spl	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\ShockwaveFlash.ShockwaveFlash.11\ = "Shockwave Flash Object"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\TypeLib\ = "{57A0E746-3863-4D20-A811-950C84F1DB9B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/futuresplash\Extension = ".spl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\ = "Shockwave Flash"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfp\Content Type = "application/x-shockwave-flash"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Control	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID\ = "FlashFactory.FlashFactory.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\ = "Shockwave Flash Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\Content Type = "application/x-shockwave-flash"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ = "IShockwaveFlash"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\ = "Shockwave Flash Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\Content Type = "application/futuresplash"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ = "_IShockwaveFlashEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\ShockwaveFlash.ShockwaveFlash\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.swf	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\ = "Shockwave Flash Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-shockwave-flash\CLSID = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	powershell.exe
4640	powershell.exe
4820	powershell.exe
4820	powershell.exe
256	powershell.exe
256	powershell.exe
4628	powershell.exe
4628	powershell.exe
3120	powershell.exe
3120	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeIncreaseQuotaPrivilege	4628	powershell.exe
Token: SeSecurityPrivilege	4628	powershell.exe
Token: SeTakeOwnershipPrivilege	4628	powershell.exe
Token: SeLoadDriverPrivilege	4628	powershell.exe
Token: SeSystemProfilePrivilege	4628	powershell.exe
Token: SeSystemtimePrivilege	4628	powershell.exe
Token: SeProfSingleProcessPrivilege	4628	powershell.exe
Token: SeIncBasePriorityPrivilege	4628	powershell.exe
Token: SeCreatePagefilePrivilege	4628	powershell.exe
Token: SeBackupPrivilege	4628	powershell.exe
Token: SeRestorePrivilege	4628	powershell.exe
Token: SeShutdownPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeSystemEnvironmentPrivilege	4628	powershell.exe
Token: SeRemoteShutdownPrivilege	4628	powershell.exe
Token: SeUndockPrivilege	4628	powershell.exe
Token: SeManageVolumePrivilege	4628	powershell.exe
Token: 33	4628	powershell.exe
Token: 34	4628	powershell.exe
Token: 35	4628	powershell.exe
Token: 36	4628	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 3320	5800	cmd.exe	90
PID 5800 wrote to memory of 4640	5800	cmd.exe	91
PID 5800 wrote to memory of 1472	5800	cmd.exe	92
PID 5800 wrote to memory of 4820	5800	cmd.exe	94
PID 5800 wrote to memory of 1936	5800	cmd.exe	95
PID 5800 wrote to memory of 5000	5800	cmd.exe	96
PID 5800 wrote to memory of 364	5800	cmd.exe	97
PID 5800 wrote to memory of 256	5800	cmd.exe	98
PID 5800 wrote to memory of 2668	5800	cmd.exe	99
PID 5800 wrote to memory of 892	5800	cmd.exe	100
PID 5800 wrote to memory of 6008	5800	cmd.exe	101
PID 5800 wrote to memory of 4796	5800	cmd.exe	102
PID 5800 wrote to memory of 1172	5800	cmd.exe	103
PID 5800 wrote to memory of 5052	5800	cmd.exe	104
PID 5800 wrote to memory of 3700	5800	cmd.exe	105
PID 5800 wrote to memory of 5648	5800	cmd.exe	106
PID 5800 wrote to memory of 1624	5800	cmd.exe	107
PID 5800 wrote to memory of 4240	5800	cmd.exe	108
PID 5800 wrote to memory of 5348	5800	cmd.exe	109
PID 5800 wrote to memory of 1216	5800	cmd.exe	110
PID 5800 wrote to memory of 5620	5800	cmd.exe	111
PID 5800 wrote to memory of 4436	5800	cmd.exe	112
PID 5800 wrote to memory of 3264	5800	cmd.exe	113
PID 5800 wrote to memory of 1452	5800	cmd.exe	114
PID 5800 wrote to memory of 5124	5800	cmd.exe	115
PID 5800 wrote to memory of 4184	5800	cmd.exe	116
PID 5800 wrote to memory of 4120	5800	cmd.exe	117
PID 5800 wrote to memory of 6068	5800	cmd.exe	118
PID 5800 wrote to memory of 3684	5800	cmd.exe	119
PID 5800 wrote to memory of 3332	5800	cmd.exe	120
PID 5800 wrote to memory of 1816	5800	cmd.exe	121
PID 5800 wrote to memory of 4168	5800	cmd.exe	122
PID 5800 wrote to memory of 4836	5800	cmd.exe	123
PID 5800 wrote to memory of 1116	5800	cmd.exe	124
PID 5800 wrote to memory of 1068	5800	cmd.exe	125
PID 5800 wrote to memory of 1644	5800	cmd.exe	126
PID 5800 wrote to memory of 4628	5800	cmd.exe	127
PID 5800 wrote to memory of 4156	5800	cmd.exe	129
PID 4156 wrote to memory of 2132	4156	cmd.exe	130
PID 4156 wrote to memory of 5044	4156	cmd.exe	131
PID 5800 wrote to memory of 3120	5800	cmd.exe	132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\LauncherClient\CAI_DAT.bat"
1⤵
- Drops file in System32 directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "if($env:HERE -match '[^\x20-\x7e]'){exit 1}else{exit 0}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\system32\taskkill.exe
  taskkill /IM TruyenThuyetDoLong.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem -LiteralPath $env:HERE -Recurse -Force -ErrorAction SilentlyContinue | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" /v Release
  2⤵
  PID:364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -LiteralPath $env:DST -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" /v "Compatibility Flags" /f
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Security" /v "DisableFlashInIE" /f
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Internet Explorer\Security" /v "DisableFlashInIE" /f
  2⤵
  PID:6008
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:4796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash" /ve /d "Shockwave Flash Object" /f
  2⤵
  PID:1172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash\CLSID" /ve /d "{D27CDB6E-AE6D-11CF-96B8-444553540000}" /f
  2⤵
  - Modifies registry class
  PID:5052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash\CurVer" /ve /d "ShockwaveFlash.ShockwaveFlash.11" /f
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash.11" /ve /d "Shockwave Flash Object" /f
  2⤵
  - Modifies registry class
  PID:5648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\ShockwaveFlash.ShockwaveFlash.11\CLSID" /ve /d "{D27CDB6E-AE6D-11CF-96B8-444553540000}" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}" /ve /d "Shockwave Flash Object" /f
  2⤵
  - Modifies registry class
  PID:4240
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve /d "C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx" /f
  2⤵
  - Modifies registry class
  PID:5348
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
  2⤵
  - Modifies registry class
  PID:1216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ProgID" /ve /d "ShockwaveFlash.ShockwaveFlash.11" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\VersionIndependentProgID" /ve /d "ShockwaveFlash.ShockwaveFlash" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Control" /ve /d "" /f
  2⤵
  - Modifies registry class
  PID:3264
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Insertable" /ve /d "" /f
  2⤵
  PID:1452
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Version" /ve /d "1.0" /f
  2⤵
  - Modifies registry class
  PID:5124
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\TypeLib" /ve /d "{D27CDB6B-AE6D-11CF-96B8-444553540000}" /f
  2⤵
  - Modifies registry class
  PID:4184
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}" /f
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 11001 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:3684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:3332
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:1816
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 11001 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:4168
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:4836
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT" /v "TruyenThuyetDoLong.exe" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Internet Explorer settings
  PID:1116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range_TTDL" /v ":Range" /t REG_SZ /d "180.93.244.31" /f
  2⤵
  PID:1068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range_TTDL" /v "http" /t REG_DWORD /d 2 /f
  2⤵
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Add-MpPreference -ExclusionPath $env:HERE.TrimEnd('\') -ErrorAction Stop}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve 2>nul | find "REG_SZ"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve
    3⤵
    PID:2132
- - C:\Windows\system32\find.exe
    find "REG_SZ"
    3⤵
    PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ip=$env:SERVER; foreach($p in 81,843,13000){ $c=New-Object System.Net.Sockets.TcpClient; $ok=$false; try{ $a=$c.BeginConnect($ip,$p,$null,$null); if($a.AsyncWaitHandle.WaitOne(4000,$false)){ $c.EndConnect($a); $ok=$c.Connected } }catch{ $ok=$false }; try{$c.Close()}catch{}; if($ok){ Write-Host (' OK cong ' + $p) } else { Write-Host (' [CANH BAO] cong ' + $p + ' khong ket noi duoc') } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
MD5 8ac3b3d1e522c27c6356583a6fe08ab7
SHA1 843f0de63fe13cc218d2671d5ca98bf1fd8e3dcc
SHA512 7491597d98da352fd86897832f1e3d01e14fec90f54625a275063124a6f419bb053029cf1482e65aae0e3b2769e9d7c6ff30d2e5c6a08412d6e55e0d14dd4408
TLSH
T13E116673F3CC8624DC5A403650CEAD1137B687CB449EDE6B7B84D155B82F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d9a5529c0cb2827dd5d6ff3f46145cf502b78d8be7d7fc0ecf8eed9064c207a7
MD5 1cfb5fd58b39eec3234133b36ca6bc60
SHA1 09427e759164ca86dd478ab06d216a028facefa8
SHA512 964f9ebd2d52dcd5cb11c89effd93410da0629ce97dc469069027043f5294d5f7f8c17d6b64f97fccaf01fd13f9e1fb1f472dedbc6b97c8e6317806bf43fa70d
TLSH
T1D5218937B3CC8724CC8A403A10CEAC1136B5C7DB809ECFAB7B84D544A42F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
MD5 705868f1da8dfb6bdcc2c97028a6df75
SHA1 0559741e798c1d22fffdf7b875373d94e6c798ae
SHA512 5f47468848b1ca69581fd73eec6fe6c5e600b11aa4fbffb514fa35c12f303d55abb81b1ef7fb4aea060ac2ea7997d91ff17a442ed06396f3c1198b0e2911d24a
TLSH
T103115733B3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jiwjerfu.fid.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jiwjerfu.fid.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Flash32_11_4_402_265.ocx

Path C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx
Size 9.2MB
SHA256 f5829c373011d9bcf88e26829dc900eb4faac99b1a07511dc974ffe9080bd1f6
MD5 c7d41058eeb57f425fbd1585f9de71c4
SHA1 88fdd76afdc2a1198103e8f4dd416d54c3ab89d0
SHA512 0492c58a37357d575ee17ce1a63fb07b7bf0b7876aa5d19d6eb5f568f740c50cbbb5af4c1ab686d57116f79dca99c8b9a01aeba704a59d1f2e3495e79dbc5f48
SSDEEP 196608:+0iIptsRKRkW3pti7pCtfmsAq/8iRhOe/zoxKmVGOts2AGeusYOV:+0HptoK/5ts4fmHiRhOeLgKmVGOts2AR
TLSH
T1DBA6CF23A7D1C0B6D09324F15137B76FA9FC6B21077499CBABC05865AA703D1963A38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4628-64-0x00000136AC7D0000-0x00000136AC7DA000-memory.dmp

Download

memory/4628-63-0x00000136ACCB0000-0x00000136ACD62000-memory.dmp

Download

memory/4628-62-0x00000136AC7E0000-0x00000136AC7FE000-memory.dmp

Download

memory/4640-15-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4640-16-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4640-7-0x00007FF804D7F000-0x00007FF804D80000-memory.dmp

Download

memory/4640-13-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4640-12-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4640-10-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4640-11-0x000002F229CD0000-0x000002F229CF2000-memory.dmp

Download

memory/4820-23-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4820-24-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4820-26-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4820-27-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4820-22-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/4820-20-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download