gh0strat | hxxps://aisino-1321215118[.]cos[.]ap-guangzhou[.]myqcloud[.]com/col-103[.]html

Resubmissions

23/11/2023, 18:30

231123-w5flfacb8t 10

23/11/2023, 18:24

231123-w16basbc55 10

23/11/2023, 18:09

231123-wrnpwscb3w 10

23/11/2023, 18:04

231123-wn4xpsca81 1

Analysis

max time kernel
151s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2023, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aisino-1321215118.cos.ap-guangzhou.myqcloud.com/col-103.html

Score

10^/10

gh0strat rat upx

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/5160-289-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat
behavioral1/memory/5160-288-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat
behavioral1/memory/5160-295-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	发_票_单20231122.exe

Executes dropped EXE 4 IoCs

pid	Process
2444	发_票_单20231122.exe
5160	fufu.exe
4292	fufu.exe
1724	发_票_单20231122.exe

Loads dropped DLL 2 IoCs

pid	Process
5160	fufu.exe
4292	fufu.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5160-285-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/5160-289-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/5160-288-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/5160-295-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LonlifeGame\hgsd.db	发_票_单20231122.exe
File created	C:\Program Files (x86)\LonlifeGame\nw_elf.dll	发_票_单20231122.exe
File created	C:\Program Files (x86)\LonlifeGame\cvsd.xml	发_票_单20231122.exe
File created	C:\Program Files (x86)\LonlifeGame\decvsd.xml	发_票_单20231122.exe
File created	C:\Program Files (x86)\LonlifeGame\fufu.exe	发_票_单20231122.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
1204	msedge.exe
1204	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
5180	msedge.exe
5180	msedge.exe
2444	发_票_单20231122.exe
2444	发_票_单20231122.exe
2444	发_票_单20231122.exe
2444	发_票_单20231122.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe
5160	fufu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5332	7zG.exe
Token: 35	5332	7zG.exe
Token: SeSecurityPrivilege	5332	7zG.exe
Token: SeSecurityPrivilege	5332	7zG.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
5332	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	发_票_单20231122.exe
2444	发_票_单20231122.exe
5160	fufu.exe
4292	fufu.exe
1724	发_票_单20231122.exe
1724	发_票_单20231122.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1036	1204	msedge.exe	84
PID 1204 wrote to memory of 1036	1204	msedge.exe	84
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4660	1204	msedge.exe	87
PID 1204 wrote to memory of 4044	1204	msedge.exe	86
PID 1204 wrote to memory of 4044	1204	msedge.exe	86
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88
PID 1204 wrote to memory of 2108	1204	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aisino-1321215118.cos.ap-guangzhou.myqcloud.com/col-103.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedcfb46f8,0x7ffedcfb4708,0x7ffedcfb4718
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6788382956626525948,11227961908690750068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6176 /prefetch:2
  2⤵
  PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5636

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25185:88:7zEvent31892
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5332

C:\Users\Admin\Downloads\发_票_单20231122.exe
"C:\Users\Admin\Downloads\发_票_单20231122.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444
- C:\Program Files (x86)\LonlifeGame\fufu.exe
  "C:\Program Files (x86)\LonlifeGame\fufu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5160
- - C:\Program Files (x86)\LonlifeGame\fufu.exe
    "C:\Program Files (x86)\LonlifeGame\fufu.exe" --type=crashpad-handler /prefetch:7 --no-rate-limit --database=C:\Users\Admin\AppData\Local\Crashpad --annotation=channel= --annotation=plat=Win32 --annotation=prod=书生ERP --annotation=ver=-devel --handshake-handle=0x230
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4292

C:\Users\Admin\Downloads\发_票_单20231122.exe
"C:\Users\Admin\Downloads\发_票_单20231122.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LonlifeGame\fufu.exe

Filesize
1.0MB

MD5
a182097a3169f5924c29d107c0b4b5a4

SHA1
8c5e7ff7a8b62de893a3cb6dad3fc028435ead92

SHA256
a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01

SHA512
0f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d

Download Submit
C:\Program Files (x86)\LonlifeGame\fufu.exe

Filesize
1.0MB

MD5
a182097a3169f5924c29d107c0b4b5a4

SHA1
8c5e7ff7a8b62de893a3cb6dad3fc028435ead92

SHA256
a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01

SHA512
0f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d

Download Submit
C:\Program Files (x86)\LonlifeGame\fufu.exe

Filesize
1.0MB

MD5
a182097a3169f5924c29d107c0b4b5a4

SHA1
8c5e7ff7a8b62de893a3cb6dad3fc028435ead92

SHA256
a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01

SHA512
0f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d

Download Submit
C:\Program Files (x86)\LonlifeGame\fufu.exe

Filesize
1.0MB

MD5
a182097a3169f5924c29d107c0b4b5a4

SHA1
8c5e7ff7a8b62de893a3cb6dad3fc028435ead92

SHA256
a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01

SHA512
0f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d

Download Submit
C:\Program Files (x86)\LonlifeGame\nw_elf.dll

Filesize
253KB

MD5
0a08d3fc727dfee403bacd01b251c47a

SHA1
d3e192bcecb0c1e8bf447be2faae9e31570250aa

SHA256
ac3ba73e7be2c30b3175471236fed821e13934fc6dee78d43d165e13b7433980

SHA512
50c90a18c2d5a05a8672f6b815717028c3146990c0a850a0a1b2cb97cfd35284e67c2612052241fcbe581724441a873f3b4880213452ce9eacd19affe681ac78

Download Submit
C:\Program Files (x86)\LonlifeGame\nw_elf.dll

Filesize
253KB

MD5
0a08d3fc727dfee403bacd01b251c47a

SHA1
d3e192bcecb0c1e8bf447be2faae9e31570250aa

SHA256
ac3ba73e7be2c30b3175471236fed821e13934fc6dee78d43d165e13b7433980

SHA512
50c90a18c2d5a05a8672f6b815717028c3146990c0a850a0a1b2cb97cfd35284e67c2612052241fcbe581724441a873f3b4880213452ce9eacd19affe681ac78

Download Submit
C:\Program Files (x86)\LonlifeGame\nw_elf.dll

Filesize
253KB

MD5
0a08d3fc727dfee403bacd01b251c47a

SHA1
d3e192bcecb0c1e8bf447be2faae9e31570250aa

SHA256
ac3ba73e7be2c30b3175471236fed821e13934fc6dee78d43d165e13b7433980

SHA512
50c90a18c2d5a05a8672f6b815717028c3146990c0a850a0a1b2cb97cfd35284e67c2612052241fcbe581724441a873f3b4880213452ce9eacd19affe681ac78

Download Submit
C:\Users\Admin\AppData\Local\Crashpad\settings.dat

Filesize
40B

MD5
3cc6739fb1d905c8e4f88f86724232db

SHA1
46c155ffd54b23b4be50a9b659a56f29fdd94e8d

SHA256
5421875891e0081608b4eb6dac3ea8e37218ff7bba14b793b8fcf100b3e468b8

SHA512
d3ca319add60b438fbbeb094643fe0fc43a21d397ee05553e7cae166f185f9f881e9108c66b0068624f601e8c019d3822b7471ff7dd7357d4ec5882a4132fe45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
775ce1ed737e2512ed6bec0dacffbe4a

SHA1
4ffa33a432f56dd62ab77090a7772e09d43a4bd6

SHA256
0c401744b6a797dda8d367e2290efce559ef251de4c4cbd2c0d958934a72f475

SHA512
6c46dea2479253f6829880573eab165d710d8fa1c97257fd43848d2ff1706cf635d0c6331578b1d4e07e8928b207edc074931a51c98f9ca7ae869df087e13df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
31cf096d283ce26f7d6ec93fde4b1e74

SHA1
1457f9efff4d061798ba9382be594b06fd302bf1

SHA256
8a83e583581c6938e4ae5aae8233ca7628488bfe62c36cc28c87d4fa1e14a5f5

SHA512
cea8a266514b4207a80cc92b6a2a7091b4cca8d502048cb7ac93ef6cfaeed7eacc113ef70cfc39d529a8f2d1d156c80f3b2932849af2234c1575ad79c420622c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c96defc665f6f97e1be79ec46b89867

SHA1
d69241c19185e1306523355cdd7d671a639ab087

SHA256
1b954c8471268d3b9ac78a2fed1bc399762906ff98edbbec0d08adf2acc83924

SHA512
feac1d33fd9602041c51ab802546b3572291342555618cc49416e2e7d058bd0e44116442e16da2a6c97396c74f764d953956e19833ed9661055b707c5feba83a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38aedd1f82c0b75523922a47cf5d8e98

SHA1
e814565a6bdf7ead351acdc6206b9d6b0102bf92

SHA256
17002a47c41fbba58c14adf4a4633c6d1af67d9d9b97ea6993ae77701958f28f

SHA512
13eb2479ced98bdbadc58f855f697994a1673da14b5bcb4aca4ea3732ca1870c770e3ca867682029cb8c6d9b9f46962e8d7ee99f928f361748e03b4a19abf6de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e8e3756c4e37c42053d78f2280bd837

SHA1
78381c3140aa5b3090daefe81183b334e36a11bc

SHA256
55cc3183c1375e159abb605a271e4dc08172ac3cc8a158b75ce89717c10f3369

SHA512
17461c5b31244c6dc72853413ccf0eb02f59e513da4f65d22ff7d7562ea5ce6dc73b79dfc7ebe4d649286f171b9085b5a632f428d3a8f0921886c37f7b4b58f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
092db0ad3b7828247d2b519cd9add9a5

SHA1
0ddd2cba56ac4706e9b6caa752ac49431205d50b

SHA256
3154ef8130df858a2f99de39db8cd0e29a8b060d5e11747a0faf23532b6bd64b

SHA512
f5eeb37e29d1d0e27054ca46604931adb05cab28f22507e898beaf92178d59d725f5d0c76cfe783b597baed39f550e2a5ae6ba81b042888d8405fd699c57b3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58920a.TMP

Filesize
48B

MD5
3408f88ee2aa6f6717760d2071367af8

SHA1
2b9d611b33bbe4ff7aa959ad4a9da96cf8566800

SHA256
0722c0ee1a18275584de3988fad095ed30770f852a63f1a1d2aa68b25fbd6ab7

SHA512
112022ac712b740600f36fa485904b17bcfcc5d8703fa435e209bd311cda68f32026cb2f302e7a6a2b4af13d2f5b15f4c73d1efc1c4e213f851dc05afe8d5355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c04a7ec1d413e84def6afd61268f2e9a

SHA1
45db6d9d0d2f4613b12a8d8895a5a8d1f8a0f182

SHA256
3bf5d199f991163d8f17566d2dcca859015363883c6b743e45c41448bc9f99b5

SHA512
2224fa6541dda06818a0f69bfa878edea3c1785794f793ee042604ca4c702ea63b36a7613e777b8fdb29112b560e5c0d7f3bf202a705d288676500c5e9c4edf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d6c7262987330e9354d9fc9dd161da9

SHA1
9a6632bb12653261440a1b9310e2cc5150e3d1bb

SHA256
299a3e126979e223491483bdd7603ccf31e057d5c0ed8ddfd0101f40d7a0776e

SHA512
0911d6519afe26c7ac34108002ce63710fc27997e61434a3daab3059270f1fa4912d9b253723620119b3bce1ee4f5b4aaa02a873c5e3603b8b713378dc0395d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 133653.crdownload

Filesize
2.5MB

MD5
4ead4a4b4e149e200d3cd6c9d6a62a4c

SHA1
fe8698ce8620b89fd5a6060af2e315ca747a19e8

SHA256
e5ff3a0cb1813a62c7e0634187bc236825632fdc3ac6540a7636745aa723df5f

SHA512
e4505c1c71797d22e1ec03029af1d6c1d0f7d87bc7e0b2475488c8bf9ed941457699681f98b642fdf943a06961f3b8b1d980222a96a9ffd5aafc4ed1ab9f9b6c

Download Submit
C:\Users\Admin\Downloads\发_票_单20231122.exe

Filesize
4.9MB

MD5
81518ac163c0a85f722b465553ccad0e

SHA1
61e99077b02ec61825ab2efd7a18fcb2b70203f4

SHA256
01bf914fd0e58210c625e7acce3705a2218786ac31b10a2f34e66f31fa72e365

SHA512
7faff2013d01569564aa873fc3a8b92234daa2f5d4e43d11469238a2ba7893283ea2c18434600eaa7ae5fcaf3178377a12e44e5b2a7f2877a44eefcbb0611c68

Download Submit
C:\Users\Admin\Downloads\发_票_单20231122.exe

Filesize
4.9MB

MD5
81518ac163c0a85f722b465553ccad0e

SHA1
61e99077b02ec61825ab2efd7a18fcb2b70203f4

SHA256
01bf914fd0e58210c625e7acce3705a2218786ac31b10a2f34e66f31fa72e365

SHA512
7faff2013d01569564aa873fc3a8b92234daa2f5d4e43d11469238a2ba7893283ea2c18434600eaa7ae5fcaf3178377a12e44e5b2a7f2877a44eefcbb0611c68

Download Submit
C:\Users\Admin\Downloads\发_票_单20231122.exe

Filesize
4.9MB

MD5
81518ac163c0a85f722b465553ccad0e

SHA1
61e99077b02ec61825ab2efd7a18fcb2b70203f4

SHA256
01bf914fd0e58210c625e7acce3705a2218786ac31b10a2f34e66f31fa72e365

SHA512
7faff2013d01569564aa873fc3a8b92234daa2f5d4e43d11469238a2ba7893283ea2c18434600eaa7ae5fcaf3178377a12e44e5b2a7f2877a44eefcbb0611c68

Download Submit
C:\Users\Admin\Downloads\发_票_单20231122.zip

Filesize
2.5MB

MD5
4ead4a4b4e149e200d3cd6c9d6a62a4c

SHA1
fe8698ce8620b89fd5a6060af2e315ca747a19e8

SHA256
e5ff3a0cb1813a62c7e0634187bc236825632fdc3ac6540a7636745aa723df5f

SHA512
e4505c1c71797d22e1ec03029af1d6c1d0f7d87bc7e0b2475488c8bf9ed941457699681f98b642fdf943a06961f3b8b1d980222a96a9ffd5aafc4ed1ab9f9b6c

Download Submit
memory/2444-259-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2444-262-0x00000000027E0000-0x00000000027FE000-memory.dmp

Filesize
120KB

Download
memory/5160-283-0x0000000000E00000-0x0000000000F00000-memory.dmp

Filesize
1024KB

Download
memory/5160-284-0x0000000003150000-0x000000000319E000-memory.dmp

Filesize
312KB

Download
memory/5160-285-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/5160-289-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/5160-288-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/5160-294-0x0000000000E00000-0x0000000000F00000-memory.dmp

Filesize
1024KB

Download
memory/5160-295-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download