e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903

Virtualization/Sandbox Evasion

Processes:

GameLogin.newLoginCycs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GameLogin.new
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LoginCycs.exe

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

9377chiyue_Y_mgaz.exeLoginCycs.exeCycsAnimator.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeGameLogin.newLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exe

pid	process
540	9377chiyue_Y_mgaz.exe
1168	LoginCycs.exe
1272	CycsAnimator.exe
5012	LoginCycs.exe
4948	LoginCycs.exe
2428	LoginCycs.exe
2648	LoginCycs.exe
3652	LoginCycs.exe
2732	GameLogin.new
2400	LoginCycs.exe
3752	LoginCycs.exe
5508	LoginCycs.exe
5608	LoginCycs.exe
6080	LoginCycs.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

GameLogin.newLoginCycs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GameLogin.new
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LoginCycs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LoginCycs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GameLogin.new

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

9377chiyue_Y_mgaz.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9377chiyue_Y_mgaz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LoginCycs.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

GameLogin.newLoginCycs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Wine	GameLogin.new
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Wine	LoginCycs.exe

Loads dropped DLL 55 IoCs

Processes:

e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe9377chiyue_Y_mgaz.exeCycsAnimator.exe

pid	process
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
540	9377chiyue_Y_mgaz.exe
540	9377chiyue_Y_mgaz.exe
540	9377chiyue_Y_mgaz.exe
540	9377chiyue_Y_mgaz.exe
540	9377chiyue_Y_mgaz.exe
540	9377chiyue_Y_mgaz.exe
540	9377chiyue_Y_mgaz.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
1272	CycsAnimator.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9377chiyue_Y_mgaz.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	9377chiyue_Y_mgaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CYCSAnimator = "\"C:\\Program Files (x86)\\9377-³àÔÂ´«Ëµ\\CycsAnimator.exe\" \"C:\\Program Files (x86)\\9377-³àÔÂ´«Ëµ\\ChiYue.dll\" 1"	9377chiyue_Y_mgaz.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

GameLogin.newLoginCycs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GameLogin.new
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LoginCycs.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

GameLogin.newLoginCycs.exe

pid process

2732 GameLogin.new
6080 LoginCycs.exe

pid	process
2732	GameLogin.new
6080	LoginCycs.exe

Drops file in Program Files directory 39 IoCs

Processes:

setup.exe9377chiyue_Y_mgaz.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exee5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exeLoginCycs.exeGameLogin.new

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2f2a7ac6-638c-4000-abc9-3f01cc5d0cc4.tmp	setup.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CycsAnimator.lnk	9377chiyue_Y_mgaz.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221123111956.pma	setup.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs_V5.0.7z	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	9377chiyue_Y_mgaz.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\replay.htm	9377chiyue_Y_mgaz.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs_V5.0.7z	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CYCSToolTip.exe	9377chiyue_Y_mgaz.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\Lieyan.ico	9377chiyue_Y_mgaz.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CycsAnimator.exe	9377chiyue_Y_mgaz.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\FunLoader\Unload.exe	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs_V5.0.7z	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\GameLogin.new	LoginCycs.exe
File created	C:\Program Files (x86)\FunLoader\Unload.exe	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe	9377chiyue_Y_mgaz.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.ini	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\GameLogin.new	LoginCycs.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe	GameLogin.new
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\Cycs.ico	9377chiyue_Y_mgaz.exe
File created	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ChiYue.dll	9377chiyue_Y_mgaz.exe
File opened for modification	C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ExpData\Logo.jpg	LoginCycs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nshCC20.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nshCC20.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nshCC20.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nshCC20.tmp\9377chiyue_Y_mgaz.exe	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

LoginCycs.exeLoginCycs.exeLoginCycs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	LoginCycs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	LoginCycs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	LoginCycs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	LoginCycs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	LoginCycs.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	LoginCycs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	LoginCycs.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exemsedge.exemsedge.exeGameLogin.newLoginCycs.exeidentity_helper.exe

pid	process
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
3520	msedge.exe
3520	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
2732	GameLogin.new
2732	GameLogin.new
2732	GameLogin.new
2732	GameLogin.new
6080	LoginCycs.exe
6080	LoginCycs.exe
5588	identity_helper.exe
5588	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4568 msedge.exe
4568 msedge.exe
4568 msedge.exe
4568 msedge.exe
4568 msedge.exe
4568 msedge.exe
4568 msedge.exe
4568 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

GameLogin.new

description pid process

Token: SeDebugPrivilege 2732 GameLogin.new
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

4568 msedge.exe
4568 msedge.exe
4568 msedge.exe

pid	process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

description	pid	process
Token: SeDebugPrivilege	2732	GameLogin.new

pid	process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

LoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exe

pid	process
5012	LoginCycs.exe
5012	LoginCycs.exe
1168	LoginCycs.exe
1168	LoginCycs.exe
4948	LoginCycs.exe
4948	LoginCycs.exe
2428	LoginCycs.exe
2428	LoginCycs.exe
2648	LoginCycs.exe
2648	LoginCycs.exe
3652	LoginCycs.exe
3652	LoginCycs.exe
2400	LoginCycs.exe
2400	LoginCycs.exe
3752	LoginCycs.exe
3752	LoginCycs.exe
6080	LoginCycs.exe
6080	LoginCycs.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exemsedge.exe

description	pid	process	target process
PID 4396 wrote to memory of 4568	4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe	msedge.exe
PID 4396 wrote to memory of 4568	4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe	msedge.exe
PID 4568 wrote to memory of 4676	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4676	4568	msedge.exe	msedge.exe
PID 4396 wrote to memory of 540	4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe	9377chiyue_Y_mgaz.exe
PID 4396 wrote to memory of 540	4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe	9377chiyue_Y_mgaz.exe
PID 4396 wrote to memory of 540	4396	e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe	9377chiyue_Y_mgaz.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 1748	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 3520	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 3520	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 2380	4568	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe
"C:\Users\Admin\AppData\Local\Temp\e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://k.shuianshanba.com/e5d94b10861ff0822286b1af802f28c36c8b87a7e8102c2a504998c94c916903.exe/sohu.jpg
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffb860846f8,0x7ffb86084708,0x7ffb86084718
3⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
3⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
3⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
3⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
3⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4964 /prefetch:8
3⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
3⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
3⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4424 /prefetch:8
3⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
3⤵
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
3⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
3⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x240,0x244,0x248,0x200,0x24c,0x7ff750975460,0x7ff750975470,0x7ff750975480
4⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
3⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
3⤵
PID:176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,5851317722682964966,8329412051132025567,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3156 /prefetch:8
3⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\nshCC20.tmp\9377chiyue_Y_mgaz.exe
9377chiyue_Y_mgaz.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
PID:540

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
4⤵
PID:3056

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
5⤵
PID:1760

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
5⤵
PID:1920

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
6⤵
PID:3504

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
6⤵
PID:3036

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
7⤵
PID:5376

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
7⤵
PID:5264

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
8⤵
PID:5496

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
8⤵
PID:5696

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
9⤵
PID:5860

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CycsAnimator.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\CycsAnimator.exe" "C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\ChiYue.dll" 1
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
4⤵
PID:3084

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
5⤵
PID:2888

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
5⤵
PID:4476

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
6⤵
PID:3364

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
6⤵
PID:3544

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
7⤵
PID:4504

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
7⤵
PID:2404

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
8⤵
PID:5484

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"
8⤵
PID:5556

C:\Windows\SysWOW64\netsh.exe
"netsh" interface tcp set global autotuninglevel=disabled
9⤵
PID:5836

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\GameLogin.new
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\GameLogin.new" "C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe
"C:\Program Files (x86)\9377-³àÔÂ´«Ëµ\LoginCycs.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion