2ca928d86351bc2a1d27cf238b25b301f65825525a03623e10bced87ea0e1814

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wg.exe
Size

2.4MB
MD5

7c456017d18bcd67d119b1852e10ea9c
SHA1

96fbe0db6d5730d5fda4cc3ee41c5b682a0ebb17
SHA256

61f70c121d427e2a7b2e70937b13099163675b51af23d0b0ec87ea312f021d95
SHA512

75f6e33dfc3ed694865710cf946789c2f1923bb70b6d8fe72f4ed0e32f315cb126350d7c1bd95d16d3f179b21d5b52583fb18e3ac4618a3a0bc42d32db7b178b
SSDEEP

49152:6000irolqOGH78ChAaqBi2tSiDLz/FX/8zptVu25IkyjGY:f00i8qONCOaqBiqDLz/VUltk25Iky3

Score

9^/10

aspackv2 evasion persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x0002000000022de7-139.dat	aspack_v212_v242
behavioral4/files/0x0002000000022de7-140.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1608	p.exe
3724	p.exe
1520	2071.exe
340	svchost.exe
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-Z568-11d2-9CBD-0000F87A369E}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-Z568-11d2-9CBD-0000F87A369E}\ = "Zou568"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-Z568-11d2-9CBD-0000F87A369E}\stubpath = "C:\\WINDOWS\\zoues\\svchost.exe"	svchost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	2071.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Wine	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Loads dropped DLL 1 IoCs

pid	Process
1520	2071.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sys.sys	2071.exe
File created	C:\Windows\SysWOW64\intel.dll	2071.exe
File opened for modification	C:\Windows\SysWOW64\history.log	2071.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\iexplore.exe	2071.exe
File opened for modification	C:\Program Files\iexplore.exe	2071.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\zoues\svchost.exe	p.exe
File opened for modification	C:\WINDOWS\zoues\svchost.exe	p.exe
File created	\??\c:\WINDOWS\Help\windowsz32.txt	p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3288	1520	WerFault.exe	86

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985182"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6FBB9B36-37D1-11ED-A0EE-426B8B52D88D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1149630199"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00266f45decbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370325793"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1149609997"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985182"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1145140822"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000066197a0ae23703badbfeda21044a9679da36fab87a8121cf3f4fee396ce5bf71000000000e800000000200002000000041bde46ba2e8edfd81e040a55d773016bdd408b723dad60ca1eade55c6c76a2e20000000e6be9ef1717f9a2ab4f232b0ae93f0c70f1d8e825cfa47bd1f6106a5c9df2c8740000000a9f7e1e516ca43744cb53e695db7700ddf6833b126f8bb4cafc0a26e6dc1d04f7517ef7e1a60cf754d3691f7935992fe2900bca7676b5bf93e1cdcdf576fc5d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1145150702"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985182"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985182"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000045d00ebbda05f670ad997df9a218b32eaa594925a0575d7d44dcb1e377e56d35000000000e8000000002000020000000e4aa464760880362a5c6563d9fc486c068f618dca90541a9063b49f182e776fb2000000007a3d5ee33e470db6ce696bc929e7d688b9792224f31b98b91a0facb027d96e5400000009fec03c97fe6cc0f7d9d218832e8c020f4fc10f94449b0c77c2cbdb0873458090e3a255db6ccd92974535cb6dc4832c9f8c3750a8a1f076eaed8fe2e38be5364	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bc9745decbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
340	svchost.exe
340	svchost.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
1520	2071.exe
340	svchost.exe
340	svchost.exe
1520	2071.exe
1520	2071.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
3980	msedge.exe
3980	msedge.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
3672	msedge.exe
3672	msedge.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe
340	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4392	iexplore.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4392	iexplore.exe
4392	iexplore.exe
396	IEXPLORE.EXE
396	IEXPLORE.EXE
396	IEXPLORE.EXE
396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1608	1600	wg.exe	84
PID 1600 wrote to memory of 1608	1600	wg.exe	84
PID 1600 wrote to memory of 1608	1600	wg.exe	84
PID 1608 wrote to memory of 3724	1608	p.exe	85
PID 1608 wrote to memory of 3724	1608	p.exe	85
PID 1608 wrote to memory of 3724	1608	p.exe	85
PID 1600 wrote to memory of 1520	1600	wg.exe	86
PID 1600 wrote to memory of 1520	1600	wg.exe	86
PID 1600 wrote to memory of 1520	1600	wg.exe	86
PID 3724 wrote to memory of 340	3724	p.exe	87
PID 3724 wrote to memory of 340	3724	p.exe	87
PID 3724 wrote to memory of 340	3724	p.exe	87
PID 1600 wrote to memory of 4756	1600	wg.exe	88
PID 1600 wrote to memory of 4756	1600	wg.exe	88
PID 1600 wrote to memory of 4756	1600	wg.exe	88
PID 1520 wrote to memory of 4392	1520	2071.exe	93
PID 1520 wrote to memory of 4392	1520	2071.exe	93
PID 4392 wrote to memory of 396	4392	iexplore.exe	94
PID 4392 wrote to memory of 396	4392	iexplore.exe	94
PID 4392 wrote to memory of 396	4392	iexplore.exe	94
PID 4756 wrote to memory of 3672	4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe	98
PID 4756 wrote to memory of 3672	4756	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe	98
PID 3672 wrote to memory of 1840	3672	msedge.exe	99
PID 3672 wrote to memory of 1840	3672	msedge.exe	99
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100
PID 3672 wrote to memory of 2776	3672	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\wg.exe
"C:\Users\Admin\AppData\Local\Temp\wg.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\p.exe
  "C:\Users\Admin\AppData\Local\Temp\p.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Users\Admin\AppData\Local\Temp\p.exe
    C:\Users\Admin\AppData\Local\Temp\p.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\WINDOWS\zoues\svchost.exe
      C:\WINDOWS\zoues\svchost.exe
      4⤵
      Executes dropped EXE
      Modifies Installed Components in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:340
- C:\Users\Admin\AppData\Local\Temp\2071.exe
  "C:\Users\Admin\AppData\Local\Temp\2071.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://ad.tjchajian.com:82/ip.html?id=2071
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4392 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1768
    3⤵
    - Program crash
    PID:3288
- C:\Users\Admin\AppData\Local\Temp\ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
  "C:\Users\Admin\AppData\Local\Temp\ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.1wly.com/
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd425d46f8,0x7ffd425d4708,0x7ffd425d4718
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      PID:332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10783126940112977348,11899786307668791556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2
      4⤵
      PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1520 -ip 1520
1⤵
PID:508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2071.exe

Filesize
114KB

MD5
6a3403a72b8efaecf87009a0cdf709c7

SHA1
4db26c3d0ef07c6107278b7583365fe47da6c03f

SHA256
3f4b5cde4f217058f2914d18e52b5e744776079b161a6297518a87027076743d

SHA512
4c114d63fc10dbccff5811b545924dd07f1690ffa581e68faf5609955ad02791a1d83313cc52bb5e6ae7a0e2c784d257c7256c3b9c78c5927ed0709e32f02a51

Download Submit
C:\Users\Admin\AppData\Local\Temp\2071.exe

Filesize
114KB

MD5
6a3403a72b8efaecf87009a0cdf709c7

SHA1
4db26c3d0ef07c6107278b7583365fe47da6c03f

SHA256
3f4b5cde4f217058f2914d18e52b5e744776079b161a6297518a87027076743d

SHA512
4c114d63fc10dbccff5811b545924dd07f1690ffa581e68faf5609955ad02791a1d83313cc52bb5e6ae7a0e2c784d257c7256c3b9c78c5927ed0709e32f02a51

Download Submit
C:\Users\Admin\AppData\Local\Temp\p.exe

Filesize
33KB

MD5
a97b8231899c20daa06ca80a3962c6f4

SHA1
8b739b51d895b5134ec308d394067b7b44696be1

SHA256
04534e4a204a516e10353a7413cd1558a48968d2c6c1fa44eeb1486876556054

SHA512
45ae5b2742aa61eaa7d0526b1d6b60b620f36d93f4d95a122a531a247124e15f8fcc0151a6eacd9c4222849a7ffa629f2b37df15b10e936367d7092b267e5127

Download Submit
C:\Users\Admin\AppData\Local\Temp\p.exe

Filesize
33KB

MD5
a97b8231899c20daa06ca80a3962c6f4

SHA1
8b739b51d895b5134ec308d394067b7b44696be1

SHA256
04534e4a204a516e10353a7413cd1558a48968d2c6c1fa44eeb1486876556054

SHA512
45ae5b2742aa61eaa7d0526b1d6b60b620f36d93f4d95a122a531a247124e15f8fcc0151a6eacd9c4222849a7ffa629f2b37df15b10e936367d7092b267e5127

Download Submit
C:\Users\Admin\AppData\Local\Temp\p.exe

Filesize
33KB

MD5
a97b8231899c20daa06ca80a3962c6f4

SHA1
8b739b51d895b5134ec308d394067b7b44696be1

SHA256
04534e4a204a516e10353a7413cd1558a48968d2c6c1fa44eeb1486876556054

SHA512
45ae5b2742aa61eaa7d0526b1d6b60b620f36d93f4d95a122a531a247124e15f8fcc0151a6eacd9c4222849a7ffa629f2b37df15b10e936367d7092b267e5127

Download Submit
C:\Users\Admin\AppData\Local\Temp\ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Filesize
2.1MB

MD5
1ecd83f218fdfefa40d45cb2712ad43f

SHA1
05ffb62a400397d9f2006a6e960cfb78f830400a

SHA256
556df8ffc43510080a4ebc2ab998e5a46f909e65e18ee80d8f21276aabd4702f

SHA512
5f7cf59f8359cd1ec599c148dd39978fd209720d0b4b85b3eae9d2cdbb064d09adabdde751327d6d71024ba9c03b76b8d79e6ae61a7ea321b44de4779b13636d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Filesize
2.1MB

MD5
1ecd83f218fdfefa40d45cb2712ad43f

SHA1
05ffb62a400397d9f2006a6e960cfb78f830400a

SHA256
556df8ffc43510080a4ebc2ab998e5a46f909e65e18ee80d8f21276aabd4702f

SHA512
5f7cf59f8359cd1ec599c148dd39978fd209720d0b4b85b3eae9d2cdbb064d09adabdde751327d6d71024ba9c03b76b8d79e6ae61a7ea321b44de4779b13636d

Download Submit
C:\WINDOWS\zoues\svchost.exe

Filesize
33KB

MD5
b8299a947177ce0dc668af3ff05c46fa

SHA1
e82e614cffffbfc2ff2b0f3130abd495cbf76b44

SHA256
ad46cf29d9a8568a66c2abc2561af34e2546d6c3009c7139b1a7761a0ce98ada

SHA512
f2b8d98592979073ba2ebd2de084485f1d1d1e8ff0d6b86a806ee2f105b7770836a0b3f77e569e8fecdb6c65c6aba08ed63b88c426dd873481eb6c792fccd939

Download Submit
C:\Windows\SysWOW64\intel.dll

Filesize
142KB

MD5
5b6ae60afa76e99a591556ba5bdc0acb

SHA1
e3f12b7fe4337a55c9e859a5ceec95f749cf457b

SHA256
7a0cbe06ce186a11a3240015a9e7adc24db91a78f35170933efdc062aa1c4378

SHA512
4394f5f198eaf5315e4dba3a03204b9ef3fd4340ef7a98fa865c7dab15fe28d9586ac8cfe738ec60c9961437586d5deba25c6622e1f8af3c4e806022c236c98a

Download Submit
C:\Windows\zoues\svchost.exe

Filesize
33KB

MD5
b8299a947177ce0dc668af3ff05c46fa

SHA1
e82e614cffffbfc2ff2b0f3130abd495cbf76b44

SHA256
ad46cf29d9a8568a66c2abc2561af34e2546d6c3009c7139b1a7761a0ce98ada

SHA512
f2b8d98592979073ba2ebd2de084485f1d1d1e8ff0d6b86a806ee2f105b7770836a0b3f77e569e8fecdb6c65c6aba08ed63b88c426dd873481eb6c792fccd939

Download Submit
\??\c:\WINDOWS\Help\windowsz32.txt

Filesize
39B

MD5
be563affdf84703821ba6e23d9ed6de7

SHA1
5d6d472ddcec06861872e9bf7d18589c4b37e982

SHA256
32d7619b9c9011c023d94e7c8d6fd234d85813d7ec7cf7cf3e74f45588c95ccc

SHA512
18e6016982f3b2a0a0b618a5e76b641303893a8d50f41a324c4e63254f7cb7e1c7fa6dd6a6f48753e34a633d268477638768bd3b8a897e8a8910d12457f4c685

Download Submit
memory/1520-141-0x0000000000F80000-0x0000000000FC6000-memory.dmp

Filesize
280KB

Download
memory/1520-142-0x0000000000F80000-0x0000000000FC6000-memory.dmp

Filesize
280KB

Download
memory/1520-175-0x0000000000F80000-0x0000000000FC6000-memory.dmp

Filesize
280KB

Download
memory/1520-151-0x0000000000F80000-0x0000000000FC6000-memory.dmp

Filesize
280KB

Download
memory/1600-150-0x0000000000400000-0x000000000066F123-memory.dmp

Filesize
2.4MB

Download
memory/1600-132-0x0000000000400000-0x000000000066F123-memory.dmp

Filesize
2.4MB

Download
memory/4756-152-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/4756-162-0x00000000775B0000-0x0000000077753000-memory.dmp

Filesize
1.6MB

Download
memory/4756-161-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/4756-158-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/4756-157-0x00000000775B0000-0x0000000077753000-memory.dmp

Filesize
1.6MB

Download
memory/4756-156-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/4756-154-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/4756-153-0x00000000775B0000-0x0000000077753000-memory.dmp

Filesize
1.6MB

Download