Analysis
-
max time kernel
192s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:38
Static task
static1
Behavioral task
behavioral1
Sample
wg.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
wg.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
逆战末日免费版0829防止非法防止检测板.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
逆战末日免费版0829防止非法防止检测板.exe
Resource
win10v2004-20220812-en
General
-
Target
逆战末日免费版0829防止非法防止检测板.exe
-
Size
44KB
-
MD5
3050bf115925685e388920797e9c9946
-
SHA1
cee5e6b0a0eda4bba0bb5b8106d4fef703c90dce
-
SHA256
acb2b2ceb098ee1b9d450dc60bc1410f7bb8f2faf7ddffadc47540fba6b3745c
-
SHA512
6d36b5b0c37e2aea21dd189d16f3521677a15e2b964e412342ba88499c1843fa7a487e985b7735f1c0159c4d9746aafb692526020b8088efa570559b0b8ba9f1
-
SSDEEP
768:RtjCjA5eMVH0tTlzM+YnVrW1xUbPYy6W1xUbPYy3k:39h0HuVrW16Y3W16YQk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ÄæսĩÈÕ¸¨Öú.exepid process 804 ÄæսĩÈÕ¸¨Öú.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
wg.datpid process 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat 1644 wg.dat -
Drops file in Windows directory 1 IoCs
Processes:
wg.datdescription ioc process File created C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exe wg.dat -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
wg.datdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS wg.dat Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer wg.dat -
Processes:
iexplore.exe逆战末日免费版0829防止非法防止检测板.exeÄæսĩÈÕ¸¨Öú.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 逆战末日免费版0829防止非法防止检测板.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main ÄæսĩÈÕ¸¨Öú.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5250C21-6D49-11ED-9916-DE5CC620A9B4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
逆战末日免费版0829防止非法防止检测板.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.wj95.com/" 逆战末日免费版0829防止非法防止检测板.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
逆战末日免费版0829防止非法防止检测板.exewg.datdescription pid process Token: SeRestorePrivilege 952 逆战末日免费版0829防止非法防止检测板.exe Token: SeBackupPrivilege 952 逆战末日免费版0829防止非法防止检测板.exe Token: 33 1644 wg.dat Token: SeIncBasePriorityPrivilege 1644 wg.dat -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 664 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
逆战末日免费版0829防止非法防止检测板.exewg.datÄæսĩÈÕ¸¨Öú.exeiexplore.exeIEXPLORE.EXEpid process 952 逆战末日免费版0829防止非法防止检测板.exe 1644 wg.dat 1644 wg.dat 804 ÄæսĩÈÕ¸¨Öú.exe 804 ÄæսĩÈÕ¸¨Öú.exe 804 ÄæսĩÈÕ¸¨Öú.exe 804 ÄæսĩÈÕ¸¨Öú.exe 804 ÄæսĩÈÕ¸¨Öú.exe 664 iexplore.exe 664 iexplore.exe 1504 IEXPLORE.EXE 1504 IEXPLORE.EXE 1504 IEXPLORE.EXE 1504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
逆战末日免费版0829防止非法防止检测板.exewg.datÄæսĩÈÕ¸¨Öú.exeiexplore.exedescription pid process target process PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 952 wrote to memory of 1644 952 逆战末日免费版0829防止非法防止检测板.exe wg.dat PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 1644 wrote to memory of 804 1644 wg.dat ÄæսĩÈÕ¸¨Öú.exe PID 804 wrote to memory of 664 804 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 804 wrote to memory of 664 804 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 804 wrote to memory of 664 804 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 804 wrote to memory of 664 804 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 664 wrote to memory of 1504 664 iexplore.exe IEXPLORE.EXE PID 664 wrote to memory of 1504 664 iexplore.exe IEXPLORE.EXE PID 664 wrote to memory of 1504 664 iexplore.exe IEXPLORE.EXE PID 664 wrote to memory of 1504 664 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\逆战末日免费版0829防止非法防止检测板.exe"C:\Users\Admin\AppData\Local\Temp\逆战末日免费版0829防止非法防止检测板.exe"1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\wg.datC:\Users\Admin\AppData\Local\Temp\wg.dat2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exeC:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exe3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.moriwg.net4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1504
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\ÄæսĩÈÕ¸¨Öú.exeFilesize
1.5MB
MD591c1583ee24aa5791e4cf2a54cf802d7
SHA1b54d05d7be32a5595aa1fb1941cc77e3712a3013
SHA256c30acd06f8aa69501b9ef174dd7ba0f32fde4f48a94a7b21e998a133280797d7
SHA5127f9a46dab0fcf7deaeabef50689d834dacd650d83bcc6cbacb3e3b398c352d9499858e736f0342b2acae1ace6adcf7d9cd8624d4643930ec8d4d4eccbc778f77
-
memory/804-5079-0x0000000000000000-mapping.dmp
-
memory/952-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/952-475-0x0000000002330000-0x00000000028E5000-memory.dmpFilesize
5.7MB
-
memory/952-477-0x0000000002330000-0x00000000028E5000-memory.dmpFilesize
5.7MB
-
memory/1644-55-0x0000000000000000-mapping.dmp
-
memory/1644-58-0x0000000076D80000-0x0000000076DC7000-memory.dmpFilesize
284KB
-
memory/1644-465-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-464-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-468-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-469-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-467-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-466-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-470-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-471-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-472-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-473-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-474-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-476-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-526-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-525-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-524-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-523-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-522-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-521-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-520-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-519-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-518-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-517-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-516-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-515-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-514-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-513-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-512-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-511-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-510-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-509-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-508-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-507-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-506-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-505-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-504-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-503-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-502-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-501-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-500-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-499-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-498-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-497-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-496-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-495-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-494-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-493-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-492-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-491-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-490-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-489-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-488-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-487-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-486-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-485-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-484-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-483-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-482-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-481-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-480-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-479-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-478-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-586-0x0000000000400000-0x00000000009B5000-memory.dmpFilesize
5.7MB
-
memory/1644-1335-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB
-
memory/1644-1336-0x0000000002950000-0x0000000002AD1000-memory.dmpFilesize
1.5MB
-
memory/1644-3889-0x0000000002810000-0x0000000002910000-memory.dmpFilesize
1024KB
-
memory/1644-5077-0x0000000002AE0000-0x0000000002BE1000-memory.dmpFilesize
1.0MB
-
memory/1644-5078-0x00000000009C0000-0x0000000000A61000-memory.dmpFilesize
644KB
-
memory/1644-5081-0x0000000000400000-0x00000000009B5000-memory.dmpFilesize
5.7MB
-
memory/1644-5082-0x0000000002C00000-0x0000000002D11000-memory.dmpFilesize
1.1MB