Malware Analysis Report

2024-07-11 07:38

Sample ID 240207-nnqfbagbb5
Target 7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8
SHA256 7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8
Tags
plugx trojan vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8

Threat Level: Known bad

The file 7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8 was found to be: Known bad.

Malicious Activity Summary

plugx trojan vmprotect

Detects PlugX payload

PlugX

Loads dropped DLL

Unexpected DNS network traffic destination

Checks computer location settings

Executes dropped EXE

VMProtect packed file

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-02-07 11:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-07 11:32

Reported

2024-02-07 11:42

Platform

win7-20231215-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe"

Signatures

Detects PlugX payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A N/A N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 110.173.53.162 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\~MHZ C:\Windows\system32\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\system32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 39004200370044003500460034003100430032003400310041003200300035000000 C:\Windows\system32\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2448 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe
PID 2448 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe
PID 2448 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe
PID 2448 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 3020 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 3020 wrote to memory of 1912 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe

"C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe"

C:\ProgramData\Kingsoft\office6\wps.exe

"C:\ProgramData\Kingsoft\office6\wps.exe" 100 2216

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\ProgramData\Kingsoft\office6\wps.exe

"C:\ProgramData\Kingsoft\office6\wps.exe" 200 0

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe 209 3020

Network

Country Destination Domain Proto
US 8.8.8.8:53 tools.daji8.me udp
N/A 10.127.255.255:53 udp
HK 110.173.53.162:53 tools.daji8.me udp

Files

\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe

MD5 f44992d14033a2b5b1064104658a29e1
SHA1 62673aa6e8bde17f218524cbe3bf50cb5b949f3b
SHA256 331f64d6d6bf7883ed8a3c29ab8ce3bf947aaecf49748a7a2b5113ced68607a4
SHA512 9a57d5765e9dcff8caccf8b51449bfd8d35f9c346c9a09a5c64a7229136490bc1cb5a3f07c8d9c75aaf48e16e01700c3d6674fc1b8d170ce927913c4130bc31b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\kdump64.dll

MD5 ae0178a893006cdc447f54e41d549991
SHA1 e5109d5f1e762ab3c52bfecdca67ccb783248bf4
SHA256 e4ba3a0debbb790a917abe7c5374350de9f7909d5a8b2fafdc1962b968013acd
SHA512 d3782758405423afec5000af001ea990fd26be0e2561cf5ec344db1f45cae072a41c0cdd107745b9bb473e535bf8220acef0a00a9992b997a0bcc7baed4a9ea9

memory/2216-16-0x000007FEF7380000-0x000007FEF73C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.dat

MD5 a1ed676cf36394b6b4fb449309b91b5b
SHA1 4cf7a01b132e4855581e39f5d0da204301fdae98
SHA256 8da2085b60e44aa5fa46c8613757e1582df098e27373b2c8916d2725f28b46de
SHA512 ce224d2376a7d78777691f9eceb8a48755787b390b73e309d48337b8d097a9370e66780237e2884294c76205f93f27e82744804781abe8eaee255c9e2f0f3f11

memory/2216-17-0x000007FEF7380000-0x000007FEF73C4000-memory.dmp

memory/2216-19-0x0000000001F50000-0x0000000002050000-memory.dmp

memory/2216-20-0x0000000076CF0000-0x0000000076CF1000-memory.dmp

memory/2216-21-0x0000000001D30000-0x0000000001D6A000-memory.dmp

memory/2216-22-0x0000000001D30000-0x0000000001D6A000-memory.dmp

C:\ProgramData\Kingsoft\office6\wps.exe

MD5 47405ed0a34dc74a75a3db147b86f8c5
SHA1 718b782e67ba20c4fa358b85c2e3db95d9277597
SHA256 fa58cf8d9add1a611700cd8e37776eae86201fbeff91d6d3620957355aee6a6e
SHA512 fcc7cb0a9a7d39931498c80ac07e53e42650b10da00f42d4a9101176a80f1b86a773409659d4d9419339fc32218f8fad1d4ac83cca9bfc72c2729f9ee05f5ae4

\ProgramData\Kingsoft\office6\wps.exe

MD5 4d77dd4a326adb474f4546b2d5981b54
SHA1 957a8f2cacd03efaf3ee66c6512eaca8f8809c7d
SHA256 55f20f55fce63d032fb1f8ae4e7f6ae8a88769bf234318ff021c4e48f3b96b0d
SHA512 30b72ef1b1296dc2b407cdf47a7788998ef3912abfc45fa13aa4f13da4e741b6cee081d92a69b1af990fc9883e6709a50c2014f4a5f9f7cd3e65a2da13a2bdde

\ProgramData\Kingsoft\office6\kdump64.dll

MD5 d0a8225739dba451de5fdebbcea7daf1
SHA1 7a58fedfcbc5d8d52e476a07a1febfdff8bd661e
SHA256 be99553ca6aec4ebe965bf9abebde22a9ecb61f33255819fa88cb93703ccb896
SHA512 05658591569fff0030c0f4aee495b643a92beb2da623b0c754ed212eebe08846b8e0cac91485cd8267e55b5d70ac1b5a117c7cf0d8dec6469fc8c5d55baeee3b

memory/1712-41-0x000007FEF66B0000-0x000007FEF66F4000-memory.dmp

memory/1712-42-0x000007FEF66B0000-0x000007FEF66F4000-memory.dmp

memory/1712-47-0x0000000001CB0000-0x0000000001CEA000-memory.dmp

memory/1712-45-0x0000000076CF0000-0x0000000076CF1000-memory.dmp

memory/2580-53-0x000007FEF66B0000-0x000007FEF66F4000-memory.dmp

memory/2580-52-0x000007FEF66B0000-0x000007FEF66F4000-memory.dmp

memory/3020-62-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/3020-64-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-66-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/2580-67-0x0000000001CC0000-0x0000000001CFA000-memory.dmp

memory/2580-70-0x000007FEF66B0000-0x000007FEF66F4000-memory.dmp

memory/2216-75-0x000007FEF7380000-0x000007FEF73C4000-memory.dmp

memory/3020-60-0x0000000000130000-0x0000000000132000-memory.dmp

memory/3020-59-0x0000000000100000-0x0000000000125000-memory.dmp

memory/3020-57-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2580-56-0x0000000001CC0000-0x0000000001CFA000-memory.dmp

memory/3020-83-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-82-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-86-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-89-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-85-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-84-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-81-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/3020-80-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/1712-90-0x000007FEF66B0000-0x000007FEF66F4000-memory.dmp

memory/1912-100-0x0000000000430000-0x000000000046A000-memory.dmp

memory/1912-103-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/1912-105-0x0000000000430000-0x000000000046A000-memory.dmp

memory/1912-107-0x0000000000430000-0x000000000046A000-memory.dmp

memory/1912-106-0x0000000000430000-0x000000000046A000-memory.dmp

memory/1712-108-0x0000000001CB0000-0x0000000001CEA000-memory.dmp

memory/3020-109-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/1912-110-0x0000000000430000-0x000000000046A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-07 11:32

Reported

2024-02-07 11:42

Platform

win10v2004-20231215-en

Max time kernel

152s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe"

Signatures

Detects PlugX payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 123.111.231.1 N/A N/A
Destination IP 110.173.53.162 N/A N/A
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 C:\Windows\system32\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 33003700320039003900390046004200300044003700390034003000370030000000 C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\system32\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Kingsoft\office6\wps.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1292 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe
PID 1292 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe
PID 2260 wrote to memory of 4252 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2260 wrote to memory of 4252 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2260 wrote to memory of 4252 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2260 wrote to memory of 4252 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2260 wrote to memory of 4252 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 2260 wrote to memory of 4252 N/A C:\ProgramData\Kingsoft\office6\wps.exe C:\Windows\system32\svchost.exe
PID 4252 wrote to memory of 2516 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 4252 wrote to memory of 2516 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 4252 wrote to memory of 2516 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 4252 wrote to memory of 2516 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 4252 wrote to memory of 2516 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe
PID 4252 wrote to memory of 2516 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe

"C:\Users\Admin\AppData\Local\Temp\7eae5cef9f7990ee8f749c2ee2d3d93027bcd4c9ad9896e641786e18009e2ad8.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe"

C:\ProgramData\Kingsoft\office6\wps.exe

"C:\ProgramData\Kingsoft\office6\wps.exe" 100 4592

C:\ProgramData\Kingsoft\office6\wps.exe

"C:\ProgramData\Kingsoft\office6\wps.exe" 200 0

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe 209 4252

Network

Country Destination Domain Proto
US 8.8.8.8:53 tools.daji8.me udp
N/A 10.127.255.255:53 udp
KR 123.111.231.1:53 tools.daji8.me udp
US 8.8.4.4:53 tools.daji8.me udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 1.231.111.123.in-addr.arpa udp
CN 114.114.114.114:53 tools.daji8.me udp
HK 110.173.53.162:53 tools.daji8.me udp
US 8.8.8.8:53 114.114.114.114.in-addr.arpa udp
US 8.8.8.8:53 162.53.173.110.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 233.17.178.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.exe

MD5 f44992d14033a2b5b1064104658a29e1
SHA1 62673aa6e8bde17f218524cbe3bf50cb5b949f3b
SHA256 331f64d6d6bf7883ed8a3c29ab8ce3bf947aaecf49748a7a2b5113ced68607a4
SHA512 9a57d5765e9dcff8caccf8b51449bfd8d35f9c346c9a09a5c64a7229136490bc1cb5a3f07c8d9c75aaf48e16e01700c3d6674fc1b8d170ce927913c4130bc31b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\kdump64.dll

MD5 ae0178a893006cdc447f54e41d549991
SHA1 e5109d5f1e762ab3c52bfecdca67ccb783248bf4
SHA256 e4ba3a0debbb790a917abe7c5374350de9f7909d5a8b2fafdc1962b968013acd
SHA512 d3782758405423afec5000af001ea990fd26be0e2561cf5ec344db1f45cae072a41c0cdd107745b9bb473e535bf8220acef0a00a9992b997a0bcc7baed4a9ea9

memory/4592-19-0x00007FFC947A0000-0x00007FFC947E4000-memory.dmp

memory/4592-18-0x00007FFC947A0000-0x00007FFC947E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wps.dat

MD5 a1ed676cf36394b6b4fb449309b91b5b
SHA1 4cf7a01b132e4855581e39f5d0da204301fdae98
SHA256 8da2085b60e44aa5fa46c8613757e1582df098e27373b2c8916d2725f28b46de
SHA512 ce224d2376a7d78777691f9eceb8a48755787b390b73e309d48337b8d097a9370e66780237e2884294c76205f93f27e82744804781abe8eaee255c9e2f0f3f11

memory/4592-21-0x00000000022B0000-0x00000000023B0000-memory.dmp

memory/4592-22-0x00007FFCA1BC0000-0x00007FFCA1BC1000-memory.dmp

memory/4592-24-0x00000000020A0000-0x00000000020DA000-memory.dmp

memory/3392-42-0x00007FFC946D0000-0x00007FFC94714000-memory.dmp

memory/3392-41-0x00007FFC946D0000-0x00007FFC94714000-memory.dmp

memory/3392-45-0x00007FFCA1BC0000-0x00007FFCA1BC1000-memory.dmp

memory/3392-47-0x00000000022D0000-0x000000000230A000-memory.dmp

memory/2260-51-0x00007FFC946D0000-0x00007FFC94714000-memory.dmp

memory/2260-54-0x0000000000D50000-0x0000000000D8A000-memory.dmp

memory/4252-55-0x0000028779CA0000-0x0000028779CA1000-memory.dmp

memory/4592-56-0x00007FFC947A0000-0x00007FFC947E4000-memory.dmp

memory/4252-57-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/2260-59-0x0000000000D50000-0x0000000000D8A000-memory.dmp

memory/2260-60-0x0000000001020000-0x00000000010ED000-memory.dmp

memory/4252-61-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/2260-62-0x00007FFC946D0000-0x00007FFC94714000-memory.dmp

memory/4592-66-0x00000000020A0000-0x00000000020DA000-memory.dmp

memory/4592-67-0x00000000023B0000-0x000000000247D000-memory.dmp

memory/4252-74-0x0000028779CA0000-0x0000028779CA1000-memory.dmp

memory/4252-75-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/4252-76-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/4252-77-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/4252-78-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/4252-79-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/4252-80-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/4252-83-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/3392-84-0x00007FFC946D0000-0x00007FFC94714000-memory.dmp

memory/2516-87-0x0000024F0C740000-0x0000024F0C77A000-memory.dmp

memory/2516-90-0x0000024F0C740000-0x0000024F0C77A000-memory.dmp

memory/2516-89-0x0000024F0AF20000-0x0000024F0AF21000-memory.dmp

memory/2516-91-0x0000024F0C740000-0x0000024F0C77A000-memory.dmp

memory/2516-92-0x0000024F0C740000-0x0000024F0C77A000-memory.dmp

memory/3392-93-0x00000000022D0000-0x000000000230A000-memory.dmp

memory/3392-94-0x0000000002310000-0x00000000023DD000-memory.dmp

memory/4252-96-0x000002877A070000-0x000002877A0AA000-memory.dmp

memory/2516-97-0x0000024F0C740000-0x0000024F0C77A000-memory.dmp