2ca928d86351bc2a1d27cf238b25b301f65825525a03623e10bced87ea0e1814

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral8/files/0x0007000000022f6a-141.dat	aspack_v212_v242
behavioral8/files/0x0007000000022f6a-140.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
4920	p.exe
2964	p.exe
2344	2071.exe
4432	svchost.exe
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-Z568-11d2-9CBD-0000F87A369E}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-Z568-11d2-9CBD-0000F87A369E}\ = "Zou568"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-Z568-11d2-9CBD-0000F87A369E}\stubpath = "C:\\WINDOWS\\zoues\\svchost.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	2071.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Loads dropped DLL 1 IoCs

pid	Process
2344	2071.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\intel.dll	2071.exe
File opened for modification	C:\Windows\SysWOW64\history.log	2071.exe
File created	C:\Windows\SysWOW64\sys.sys	2071.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\iexplore.exe	2071.exe
File opened for modification	C:\Program Files\iexplore.exe	2071.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\zoues\svchost.exe	p.exe
File opened for modification	C:\WINDOWS\zoues\svchost.exe	p.exe
File created	\??\c:\WINDOWS\Help\windowsz32.txt	p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2344	WerFault.exe	81

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985199"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370333019"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	炫舞邪少助手3.0.9-1.23A(心动增强).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{40F7D6F0-37E2-11ED-AECB-7ED4F7B3352B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985199"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "381875608"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "381865429"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "398175443"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8054571befcbd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985199"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ddb41befcbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000f919ecf4e7f01b51f87c9a0e40baf6465b1962fd22b96c2b475405d96971ba83000000000e8000000002000020000000f68527ca116fcc24fbf39179d4f5d099cd231ab4bedeb2e974b0294afc6c5cb720000000192e5a9a681467e8bb172e1ec7169f6a8328528d4f04f64a7d9c55ec389a67214000000070c4eae36957036a0435f01792f9d3e7dc150b153dff52edc0871be44373affb5180a5b5b9b8dbee042f15c6bbce5ed010d957e61682f838c2bf76d9a8468439	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000399881e7942bb2328dbdea150bf71e6253cc581e06d8d3ab1e672f2cb9896e19000000000e8000000002000020000000a5a24c36de58bd8aa0b1f6ae4df2ce6b9e01c401517bba06672071670a673eec200000008ab3f5dd4babe62b51cc314dec395791c2a632008d9629cb71e8e738788c50a940000000b0acb7efa8b9a1ed83dd8ec257e55244cdd82fa7187524485e838206fa4f528c2110ebbd85dd8c66f048d9e9cd855d17a49f5a829e9bfc6c2c28709e755b500b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.wj95.com/"	炫舞邪少助手3.0.9-1.23A(心动增强).exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4432	svchost.exe
4432	svchost.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
4432	svchost.exe
4432	svchost.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
2344	2071.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
5068	msedge.exe
5068	msedge.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
1096	msedge.exe
1096	msedge.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4220	iexplore.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4364	炫舞邪少助手3.0.9-1.23A(心动增强).exe
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
4220	iexplore.exe
4220	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 684	4364	炫舞邪少助手3.0.9-1.23A(心动增强).exe	79
PID 4364 wrote to memory of 684	4364	炫舞邪少助手3.0.9-1.23A(心动增强).exe	79
PID 4364 wrote to memory of 684	4364	炫舞邪少助手3.0.9-1.23A(心动增强).exe	79
PID 684 wrote to memory of 4920	684	wg.dat	80
PID 684 wrote to memory of 4920	684	wg.dat	80
PID 684 wrote to memory of 4920	684	wg.dat	80
PID 4920 wrote to memory of 2964	4920	p.exe	82
PID 4920 wrote to memory of 2964	4920	p.exe	82
PID 4920 wrote to memory of 2964	4920	p.exe	82
PID 684 wrote to memory of 2344	684	wg.dat	81
PID 684 wrote to memory of 2344	684	wg.dat	81
PID 684 wrote to memory of 2344	684	wg.dat	81
PID 2964 wrote to memory of 4432	2964	p.exe	83
PID 2964 wrote to memory of 4432	2964	p.exe	83
PID 2964 wrote to memory of 4432	2964	p.exe	83
PID 684 wrote to memory of 1812	684	wg.dat	84
PID 684 wrote to memory of 1812	684	wg.dat	84
PID 684 wrote to memory of 1812	684	wg.dat	84
PID 2344 wrote to memory of 4220	2344	2071.exe	85
PID 2344 wrote to memory of 4220	2344	2071.exe	85
PID 4220 wrote to memory of 1800	4220	iexplore.exe	86
PID 4220 wrote to memory of 1800	4220	iexplore.exe	86
PID 4220 wrote to memory of 1800	4220	iexplore.exe	86
PID 1812 wrote to memory of 1096	1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe	94
PID 1812 wrote to memory of 1096	1812	ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe	94
PID 1096 wrote to memory of 3856	1096	msedge.exe	95
PID 1096 wrote to memory of 3856	1096	msedge.exe	95
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97
PID 1096 wrote to memory of 3472	1096	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\炫舞邪少助手3.0.9-1.23A(心动增强).exe
"C:\Users\Admin\AppData\Local\Temp\炫舞邪少助手3.0.9-1.23A(心动增强).exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\wg.dat
  C:\Users\Admin\AppData\Local\Temp\wg.dat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\p.exe
    "C:\Users\Admin\AppData\Local\Temp\p.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\p.exe
      C:\Users\Admin\AppData\Local\Temp\p.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\WINDOWS\zoues\svchost.exe
        
        C:\WINDOWS\zoues\svchost.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4432
- - C:\Users\Admin\AppData\Local\Temp\2071.exe
    "C:\Users\Admin\AppData\Local\Temp\2071.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://ad.tjchajian.com:82/ip.html?id=2071
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4220 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1752
      4⤵
      Program crash
      PID:2144
- - C:\Users\Admin\AppData\Local\Temp\ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe
    "C:\Users\Admin\AppData\Local\Temp\ìÅÎèÐ°ÉÙÖúÊÖ3.0.9-1.23A(ÐÄ¶¯ÔöÇ¿).exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.1wly.com/
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff87d4a46f8,0x7ff87d4a4708,0x7ff87d4a4718
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10188891415035054036,5615342680629970203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        5⤵
        
        PID:3472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10188891415035054036,5615342680629970203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10188891415035054036,5615342680629970203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:8
        5⤵
        
        PID:1888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10188891415035054036,5615342680629970203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10188891415035054036,5615342680629970203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
        5⤵
        
        PID:1204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,10188891415035054036,5615342680629970203,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 /prefetch:8
        5⤵
        
        PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2344 -ip 2344
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion