Analysis
- max time kernel
122s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
Resource
win7-20240215-en
windows7-x64
19 signatures
150 seconds
General
- Target 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
- Size 2.0MB
- Sample240520-aggmyaac77
- SHA256 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9
- MD5 6036bd73dbef78a0bb21bace81ca703f
- SHA1 59cb4799cafe00aba015c8a8eee53d3826e616d1
- SHA512 be5c11d73fd0c8edf0a1d89c79fd2847511efdc401fe057624c0de67a01d1047b2c76f636733d71c46557c4b6d855ec37694fccf368ee8057901662b4a38adfb
- SSDEEP 49152:ZlqwRsD6EZq9NBN8EFWI6xuPFT4u6Dr1LJPMxi:ZlqwRsOEiTVFM2T4FDt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 2156 powershell.exe 2156 powershell.exe -
resource yara_rule behavioral2/memory/2748-3-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-4-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-5-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-7-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-15-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-20-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-14-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-6-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-13-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-18-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-22-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-23-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-26-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-24-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-27-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-51-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-54-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-55-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-57-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-58-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-60-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-66-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-67-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-71-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-72-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-74-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-77-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-78-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-80-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-82-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-85-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/2748-95-0x0000000002490000-0x000000000354A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\M: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\R: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\T: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\U: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\Z: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\H: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\O: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\Q: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\S: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\W: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\I: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\N: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\J: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\K: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\P: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\V: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\X: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\Y: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\E: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened (read-only) \??\G: 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\ 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification F:\autorun.inf 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wndr.cat 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\normal.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\normal.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnTen3.fes 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnPatemar.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnUninst.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\7-Zip\7z.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\wndr.cat 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnPatemar.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wngj 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\Icon\main.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\wke.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnCosemism.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnKernel.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnMfgohsht.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnSvccen.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnSvceous.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\normal.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\update.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\update.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnSeve6.tff 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnTen6.tff 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnFerous64.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\Wnfghshmndf.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\main.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnTen3.fes 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnMfgohsht.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnQdX.tsc 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnSeve3.fes 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnSeve6.tff 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Wnhghshtol.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnSvccen.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnSvdarme.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnSeve3.fes 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\Wnhghshtol.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\Wnhghshtp.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Wnhghshtp.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\update.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnCosemism64.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnFerous.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Wnfghshmndf.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\Icon 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnAcelein.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wke.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\WnAcelein.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnAcelein64.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnKernel.dll 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\WnUninst.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File created C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\update.ico 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e574873 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe File opened for modification C:\Windows\SYSTEM.INI 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe Token: SeDebugPrivilege 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 784 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 9 PID 2748 wrote to memory of 792 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 10 PID 2748 wrote to memory of 316 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 13 PID 2748 wrote to memory of 2712 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 49 PID 2748 wrote to memory of 2756 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 50 PID 2748 wrote to memory of 2988 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 51 PID 2748 wrote to memory of 3408 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 55 PID 2748 wrote to memory of 3628 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 57 PID 2748 wrote to memory of 3812 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 58 PID 2748 wrote to memory of 3908 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 59 PID 2748 wrote to memory of 3976 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 60 PID 2748 wrote to memory of 4064 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 61 PID 2748 wrote to memory of 3940 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 62 PID 2748 wrote to memory of 388 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 64 PID 2748 wrote to memory of 3404 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 74 PID 2748 wrote to memory of 2864 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 80 PID 2748 wrote to memory of 784 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 9 PID 2748 wrote to memory of 792 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 10 PID 2748 wrote to memory of 316 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 13 PID 2748 wrote to memory of 2712 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 49 PID 2748 wrote to memory of 2756 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 50 PID 2748 wrote to memory of 2988 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 51 PID 2748 wrote to memory of 3408 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 55 PID 2748 wrote to memory of 3628 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 57 PID 2748 wrote to memory of 3812 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 58 PID 2748 wrote to memory of 3908 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 59 PID 2748 wrote to memory of 3976 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 60 PID 2748 wrote to memory of 4064 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 61 PID 2748 wrote to memory of 3940 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 62 PID 2748 wrote to memory of 388 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 64 PID 2748 wrote to memory of 3404 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 74 PID 2748 wrote to memory of 2864 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 80 PID 2748 wrote to memory of 784 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 9 PID 2748 wrote to memory of 792 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 10 PID 2748 wrote to memory of 316 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 13 PID 2748 wrote to memory of 2712 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 49 PID 2748 wrote to memory of 2756 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 50 PID 2748 wrote to memory of 2988 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 51 PID 2748 wrote to memory of 3408 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 55 PID 2748 wrote to memory of 3628 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 57 PID 2748 wrote to memory of 3812 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 58 PID 2748 wrote to memory of 3908 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 59 PID 2748 wrote to memory of 3976 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 60 PID 2748 wrote to memory of 4064 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 61 PID 2748 wrote to memory of 3940 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 62 PID 2748 wrote to memory of 388 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 64 PID 2748 wrote to memory of 3404 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 74 PID 2748 wrote to memory of 2864 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 80 PID 2748 wrote to memory of 784 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 9 PID 2748 wrote to memory of 792 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 10 PID 2748 wrote to memory of 316 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 13 PID 2748 wrote to memory of 2712 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 49 PID 2748 wrote to memory of 2756 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 50 PID 2748 wrote to memory of 2988 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 51 PID 2748 wrote to memory of 3408 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 55 PID 2748 wrote to memory of 3628 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 57 PID 2748 wrote to memory of 3812 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 58 PID 2748 wrote to memory of 3908 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 59 PID 2748 wrote to memory of 3976 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 60 PID 2748 wrote to memory of 4064 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 61 PID 2748 wrote to memory of 3940 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 62 PID 2748 wrote to memory of 388 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 64 PID 2748 wrote to memory of 3404 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 74 PID 2748 wrote to memory of 2864 2748 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe 80 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2756
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2988
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe"C:\Users\Admin\AppData\Local\Temp\689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Maps connected drives based on registry
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2748 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle hidden -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WanNengSoftManager\'3⤵
- Command and Scripting Interpreter: PowerShell
PID:2156 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:548
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3812
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3908
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:388
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3404
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\WanNengSoftManager\WanNengSoftManager.ini
- Size 194B
- SHA256 d6da1cdd18fb7b2ee0ea3674e24107b944619eb9e19a8c9b5d9316b3aa197812
- MD5 8169df157e5aaa7814e19e4a312a8e6e
- SHA1 9250c428993ae78da6f578af6ee968d632f14b32
- SHA512 6d18b5048bd4f1d27fe6485af088bafea5bfdbe56b7cd68b5f8982e0b874601fe304b8f0f68c91a2e120c48c1267409e5bbc24a1020c7bf223fd1c6dce0f52f1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\WanNengSoftManager\Icon\main.ico
- Size 197KB
- SHA256 87868f0c311ba96d5f8069b070a8309d2a54813535ae99d852cff44a23f626f6
- MD5 e1bd484966a645a7b456a67ed4a2677c
- SHA1 528d589847d60b41e5faa40c6ee5e1d361df0c55
- SHA512 8f76bc32ab178b056a7c01608e8a0596aa1784f290837a8f0b844f097a4170d3cf9ed400f9c27de1ccdc645e012a66f086069a922ed2de9bd28cda584cf57dbc
- SSDEEP 3072:ljLNJrrwkPcB1fDmehJloFcfgTQ/rKmSdEqdUBQuw:VLvrr9cB1ap7Q/rKmSX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini
- Size 213B
- SHA256 7bf8e8c3d18ee13e02bc5a8917717d0b91d1c1f4a52cfbb944b618f15e3b4f10
- MD5 78c996d1c37af3ef09b0c61a08cc2972
- SHA1 b4e98c080a418ddf736758648a11c6f6c44ac0eb
- SHA512 352450c33ed4796cb7649dc60e26b6a647a8f2dbed52b99600999986e37c825f113747f36ae751ca6be2adeaff948ab6f0c9dc9c04cade1f7bfa438496614635
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\WanNengSoftManager\WnAcelein.dll
- Size 219KB
- SHA256 a1cdb58efe50c9824776219541ec36fc9532f0dc68e6f95321bdf4c538387637
- MD5 8e2c5d3c053319ed8d63483d256449bc
- SHA1 961dfe8155befb9947f58c84df4c4fb32623c911
- SHA512 18b2e3b861db93b1ea1ac090791296aa25d1d2a6584b2624b982f044fb0142c4c413e134cc244d3b3273f90150ee7a22fda1a92bdb5f1f34bf95281579a8f042
- SSDEEP 3072:WWu7FNV1Pmusky9RmiT5NovoJ75zudktzEtpMvgkz4BgIwWAg0FujraSrgt/cU2J:duvVRiT5N/t8kzETDAOnpg1D2J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnAcelein64.dll
- Size 264KB
- SHA256 d8dd77d93a35ffe5d55f16497ccb3ab9cd0c4214d9b6d82ce48c9c2ab2cbb697
- MD5 1b900520d1c09713f2906f4c5b9d8615
- SHA1 38f9967da362505caa4b8a02847288662752447d
- SHA512 ccadfd98bf7b4127ba2feb0c040b4af27c2749cc4d063ba6a3f96b10e24fdf237f98f3a9f923f3187461237bd402e7e6bd086fb1bff8847d0e49981f1f639f12
- SSDEEP 6144:8ERAFX3N2JPiXwLzXE2kCbwc98Z/mzdMjTDiJ6gQohxL1Rp:LRAmJPiXwLLEmJ98NgQoND
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnCosemism.dll
- Size 426KB
- SHA256 355943ed9b2bbb59ab4298b83d3a98290a42fcee87a1cd46e7c777161a09c106
- MD5 7b77180aa387e2480811c118a30dd05e
- SHA1 159d07f6a313f130f046af392aaad50bab80eeb6
- SHA512 90549e017e331761632f8b5fddecfba928401fce2a5afef5aee665f980d529666ffb36eb5bd5e9cec78b051b4d3bbfaa35f0b72b85cc706176b4a1b5422b6afb
- SSDEEP 6144:rfQ8UAN4n6HMbjSyP2f932w2cfmYAO2D2QSpJeJB18uQ/rKmSDaawg:rbUU3HMag4oVYCc6JBzQUwg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnCosemism64.dll
- Size 475KB
- SHA256 550994432a9ebce0b266a2d7892194e89d5aab4b2b6d7dae6b102fcdcb803c84
- MD5 d468405798b4794714b55d7acb5c337f
- SHA1 6131ea842c69cb2cf0b8f1b1be1558168e023fb1
- SHA512 ca64de673d4a2f4fd63ed7347f7d9e0743c5ee5583563423429f1d19952f43cb91ee61e8b85f08731325700e92836d5d4026d79929b0e1811c25a6aa06e8ee1c
- SSDEEP 6144:jkK5sZsWbZYx8DrN1AAz23nDT65gMN+Nx0UB2vqohtr5rtxSpJeJB18uQ/rKmSX:jkK5sZsYYyr3zqnDxB9olRg6JBzQU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
- Size 4.5MB
- SHA256 5b8a6f3d529c085601d971ef44c4d6bf4bc8b05cd765a6986cb2968473374103
- MD5 30d04c3ac9a0a938f0742c504ad7b256
- SHA1 46966a65cb4c4e74cd949bc2615776701564b67b
- SHA512 17ec81395837c365f61e43fd162ab4215dd1c2c035348205ce48d568d28894aa3b078c30040964cd1ca580e2df1aa92c5a827ccc247e5fdc880c5d8ee84a3765
- SSDEEP 98304:Gc46eeKH2ciSzzjXqqIlLSAsbuy+6ZZZmuI0RDqUQqU5:ENH2ciIolNpP6ZZZJI0QU5U5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnFerous.dll
- Size 250KB
- SHA256 3ef4d209c611807a27b2e01298ef2651a25b01f389ef59c60997a019bf14c575
- MD5 6b5253223698a88ea8393c0bb324aae8
- SHA1 df156ead59e070d232aa6488c8ce1d857617aa15
- SHA512 595aa7805198984cbcceffc71ad45d1fb4b6651987030a78dc703f0f0d575ddb7606c69fc5aa1e563a8d679f0b56b32c436b1a299f1f5e173d23d35e8ecc0a18
- SSDEEP 6144:tQ8D6qO4/rWy9lQxgCK3rydEIrDAOQvpLjKAi:lD6e/rPQxgd3WdEwD4oAi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnFerous64.dll
- Size 303KB
- SHA256 c7fce5752658147e008cbfa8b39dfdb51615ff2c0e73866483bf829c375b8ce5
- MD5 acd59a749f0e56a163bddc1f454f69b2
- SHA1 08f05945d666c6e19e0e8eaf0ab14d26eaa424fd
- SHA512 627b027abdd502738958bbf62fdf737cf8a0930e4ac5c54e4ef5d74e6493d196b69a6b3911518d115fbcf039868e16e88ba7b1d6c01d8a993c945e99bb6ab234
- SSDEEP 6144:Pp/apet03Cd26X+R1zWhPaoN4w9JJ5GuymVuYvRdohmtHlg:h/ape+3Z6X+R1zJo39JxvLowS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnKernel.dll
- Size 2.7MB
- SHA256 b485275db6102a1c1fa41b8b260d35bbdb7600d6d1c32099c54b3b6750556699
- MD5 de11310bfdd3f2d2bf49201dd1914699
- SHA1 4625d4d3bf4ece6599fbb1abd7357438c6d76ae5
- SHA512 ee91e6d5953207ed69b011ed06ed1fc95fcf86d392009802a6f4d080fbe306123c30cfc7a5e64839a51c5cd018a4e147dc3b962088a3a30ba2f0880ba59b437c
- SSDEEP 49152:DuLVnGRiStI5B6bbqrautppJAEY7mcPNHUgqlBxuIG0JQTu7LDKuMNkb56faC:DUu/I6irautlGHuLK8bE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnMfgohsht.exe
- Size 2.3MB
- SHA256 64b9caf38355a451b34e8a7d012fb7e60eb4b76fd98fe82c096e0e34268d7d51
- MD5 c9f30057628368706bcdc4cc1da5fc27
- SHA1 8447d2ec544b4288c0eb4f0c913cdda8e475fc31
- SHA512 c9135fca1f79531a5ff16c6a641dd110952f7b28958a245fc75a7ff2a8c8c271b4c2c95ba2f288909ffbfefca70c7c12f0a8ae0d763c69d5a93bc50b5ca35eb0
- SSDEEP 49152:ndJP2Me/HBWbQfClOtwZM2ByW9Xr+x6HiPy6hBx2qUrjPc6Cw+fusYM:dJ+Me/HBWsfCVK2ByW9XrLN6hiqUrw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnPatemar.exe
- Size 2.4MB
- SHA256 de8eac7f944a6c99a894b74fa4327f765cb381d4745602f3acbbcf1c3a7ff5ab
- MD5 1a8d6b945faa865f5c189bba5df42844
- SHA1 10b7c7628a40a882de155722c2d7942734fe4901
- SHA512 579993711e6eba9a54f72a04f13209255e50656277dac9e0309ca77afec3acbe12ad3ccb4337afde70e2d5db7453a0ab557585e45da4699ebe03bf1d635777b6
- SSDEEP 49152:Hrh4WgokR4MR2ICkgJu/xiOto6PUYhrEqUZgw7S6wKX:LhBgoknR2PQNSTYhwqUZp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnQdX.tsc
- Size 42KB
- SHA256 ce792fbac3c45906e948319f9e06d2854ee6ab580220f66c562cd75358b1a894
- MD5 2c4fdced429b803305607ed171dff5bb
- SHA1 449000b216cbb472bc18b122c4fa516adb299a19
- SHA512 f499a42044774222c3221fde90b0c33617ff329b2d858e242a31f6f365c8b36a7628dca24c41d92cf2adfc36813ba5cb309f48c5ad616377b348124837784465
- SSDEEP 768:Uf5APoxteCaRGKBpmW/9GWaeUe/MEpYiTPx+2i:UBvxterGMpxQzeUe97TPxri
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnSeve3.fes
- Size 39KB
- SHA256 844a4a6d945fbce245cde1f3edb7ed3c93b36b472a3a00c347d210c4e459f921
- MD5 e220627df0f7912ca9abf9003e3536ac
- SHA1 5dfade04a3a08d68f2937b89792c06db299eaa7e
- SHA512 a69326f0ba5450f859308a9a1d44d7f021ac7209674274ddb8437ab885567f39cc4571f38b739ea731510c7755e3afd4923e28d20cbfdc162fd41c1920592c9e
- SSDEEP 768:MVXr9uzQqIQlGXGanZLreUe/MEpYiTPx+SzhJ:Mhr9uzQqfGWaZLreUe97TPxbJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnSeve6.tff
- Size 45KB
- SHA256 241610908c9f40566296f34066195c0606b577595b84cfb282337b58e23d07e1
- MD5 17758d686860dddfa39a0515829a23c6
- SHA1 f9efe7b295d31b3e8c359f8e3fe2e893fd0ebfce
- SHA512 664f0a90c40d7789bef2e4866e96145d32d5dfafe329b6c62c54fe9bf367317ba5b69962454d62e4c94b9b9530df3d64d702bd54bac24ab380243ba6b6426a4b
- SSDEEP 768:1tgwEQTso10UZGxlPPgtBrzCWsEEusSYNeUe/MEpYiTPx+A:1tsdkkTngOWsEEusHNeUe97TPxV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
- Size 7.1MB
- SHA256 5a2102ff5ad0f9ed8a1c10119e90f9d2bc432595df4b7fe85b089bd14527fc81
- MD5 14f78023f4a504ace87f681028eae4be
- SHA1 8eb62dd9894adcd90bb080b7cb33bd9affc3c05f
- SHA512 24f6e3b3116c8dfd297cc766bc8e54fa6f40ce82e2d6910a195b684e9055c5922b3206a80e5f4dc7a0144e678309e21ff46b6cdc26b56eb313f514cbe52ec998
- SSDEEP 196608:vAFGGbcS4iXRzDEx2/NM5CZnKUa1vs5gtMw/om:vA4EdRzDEpC5KUa1Nx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnSvccen.exe
- Size 2.5MB
- SHA256 f5cd65baabbcc556b0beae9e6e65b71b5fd19b44f7776cfaef9b6bd09bb156f5
- MD5 db101c5d26f7d92064c6d3faaba20175
- SHA1 683afd3c7512886d0f4c5987deefafb5f396b573
- SHA512 07f56957258ed8bee16577998bbf97f7d8ff799cacf865fdb47029dc008af6df632ac55e860b0f859b7525d41478f06885bda89185b67f73c79eccc30ec83503
- SSDEEP 49152:JNnRk2rdAALOWnivFgYnkbmgtRP0WyW/qUMq2FvKSReyc:JNRk2RAACjFtk5CWyKqU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnSvceous.exe
- Size 2.2MB
- SHA256 1ee4e893e72d4475d49ac22d3290a8a7e2fb2a14cbc22eb6edd2d382b2ce20e3
- MD5 7333a527dbedff3be88294d07dd9e4a1
- SHA1 6aeb844db20b0f440734bf53283e57619834db7a
- SHA512 12f60e7caecff70bf3daaf36dab9d1b9bb0b548624da62a387fda2ce57927961d1fcd0631be31b4247f4190d056f5e6d60bba8d50597714285e1632e86294580
- SSDEEP 49152:YLcG5Gyz75LYZKbY+WNojkCNEerPAPO19RE5fCy:YLcG5vz75LgKbYVYkAkPOA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnSvdarme.dll
- Size 2.2MB
- SHA256 b3c7a548073644da7d501e663cad09feef8ff30a2b232e58e2c50b6c8ca9d801
- MD5 2ea1bb79182e0832833828cf04288fbb
- SHA1 3613dfa6fd8a15ad931db368fd4928d4836143e0
- SHA512 55f443552a1cd1762dd5eabb35db459cc51d2bfadfa07a3a7fcaca99d437c1d077b84f660a08805af64c69bef0d0561c579c6d15e01b44b02218f8a932b813e5
- SSDEEP 49152:UEpMK337Kh5pE8Ohigt4+RLPrkvqD0O3ED3NpT:UEGq7SU8tgttfkvr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnTen3.fes
- Size 50KB
- SHA256 64cad370d5373313a05e71efc4d719b17b4801576356e693b47e4515fb64641a
- MD5 6a99dce0aa4798a921799231fb98d0b7
- SHA1 f986740992007f92ddb6db452a0d4ee7a3de3b3c
- SHA512 31b684a3e72d36f6077f792257c4fd33ba79eb7a02e153b0898bfcaa64c8dac931b7ee7b371784b88b47a014fd744df2743388773444b82d25d65932b64d6eee
- SSDEEP 768:RVXr9uzQqIQlGXGanZLReUen5YiKBPxWEg75ym3cI+9z28d:Rhr9uzQqfGWaZLReUe57KBPxJmCzRd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnTen6.tff
- Size 55KB
- SHA256 5eccd83aa0e78f466a14fa4862d273eaa1999fed6cef6f451c6d7b829ea71388
- MD5 39b59f56c7cdcc204ea2e2f44f0f11ba
- SHA1 5a6b0fa4849b38fd75edb0b66c1e8fcd4f70b17a
- SHA512 88b8ccfc1989cb4eb365562240a96117e2cb90601f053e803bee1c10defd17323a10e946797bd721bae6b4d8255a03f06a04266010ae838657e37c06525b85b5
- SSDEEP 1536:AtsdkkTngOWsEEusHseUe57qPxQmQ2zgB:AdOHE/SseUe5KxQqc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
- Size 2.9MB
- SHA256 bffb5df552ff14235d9c09b47e15b9755beda1f1e2957ef65475ddb6f603a1ac
- MD5 c962318702eac982494f55762d5358e5
- SHA1 dfee67eec82c97614261ad826020e95b9183fa45
- SHA512 9f8a7082654fe3bec0eb92c9955776982e12dd123f67baf9457263219a4ccf7bd8b28438125690bdf07abc7132d1cd57f85a3ce6124112b9995081b358b2c4c1
- SSDEEP 49152:LgwpxPJg7JW4jhzQpxSlDvZajSiOWJ40PCLdt5bqUl33kwpt:Lgwpxhg7JW4NkpqiOWJ4PLdTqUxt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\WnUninst.exe
- Size 4.3MB
- SHA256 dd62ffa2383984ce8c009cb55cb6818afe9b343d6c8dc73f6f78210aa4d9e6f5
- MD5 4c87ae53f9687a128563aa0bdd931e3a
- SHA1 f08b3e12e5e3492a8b0f14e2230c0da4099f9a88
- SHA512 e26bf9065a0d976fe3533b35c4e3193e98bec8cf46855bdfd58ce5b86106a1a8b4655c41d40dd407f2702dbaaa5d0b9c0ab7e73010fe2dd957ab5f2a010bc832
- SSDEEP 98304:Sk/14zFDDgietBRSf/7hz4Y5imuPhI/uJ2daMRwIY:SQoFNet/SVb59//ucYIY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\Wnfghshmndf.exe
- Size 2.4MB
- SHA256 6c51048d92d86081bd5323e2ce25734a2b5d0991585dcab95dd051b87204334b
- MD5 3003134f2f47ee73ea52bd7690854274
- SHA1 5ef19e5392cb71a98186ca2fa3fafafc1a8fae12
- SHA512 d4ba9175b4a0e2a7b8ba377d731a0c76dadaaad254630bd62781fbf72339c8228c501e9ddad0f456b1de9beac40910f1f2a964d78064e457e6f1e88cf7864965
- SSDEEP 49152:EvaVivb0Ek/uOaxO9aca2JP05ABxCIWqUNA/usYy:Eva8vb0F/y+B+5ABMqUK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\Wnhghshtol.exe
- Size 2.4MB
- SHA256 c7459aeab6058396ccffb3e0b7cc45fbc39b90b86ec3c50accc4a5e10ff52edf
- MD5 a177078edd4918268d7c2f9b0ba086a0
- SHA1 c8229ded91155bfe0de7ed49fa6df988129f7064
- SHA512 e6f9680b897266453706cd236324551ed69ef9aa5061a5c1c5ad45acce8fb635d09174c760ce998403261e774d3bff207d73d2a26e97b78d9c120cf735f069b3
- SSDEEP 49152:DtJjUQLHazyHder/A41cIWgEO7zH3pf4/V+JPxqLgaLqUrUIRS5Nw:DHjvL6nr/A4J5P3DqL/qUl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\Wnhghshtp.exe
- Size 2.4MB
- SHA256 98813ebe375289f2f514fa2064c5817f9bea0e89a91f16455918b46e42d7ed43
- MD5 db553556e221b52c88a80b8005704737
- SHA1 a76664b31a66d6f117a50224010616a335fd8e21
- SHA512 4647a12b9ca93a4fd0cab4df518e5b0a66a5c5984ade09db335905cdd9da89074572ad3011c9f4a14823a08653183ba6ab4cf799ff1dd10fc13f3346f9d7d71d
- SSDEEP 49152:uQ4FiPb0cknuOaJO9acs2JP05ABxCJgqUsA/usYpn9:uQ4sPb09na+f+5AB/qUY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\wke.dll
- Size 11.2MB
- SHA256 bb68484b71147c91d664bb23de320fdfdec1cdb42d64a3dd9ca74010e8d47592
- MD5 cb099b500ceb0e2c123ceef14bd7183e
- SHA1 7c7538b9bade66b4561bc14183b31deec50d0021
- SHA512 f74f5dde21c733cbaa5e13434d2a82db6baa45a22bb1c466b4a064f77af625e0672dfca81dada6c8f0cc3c2f8df995be583dce15c236782b01c90d1be7073705
- SSDEEP 98304:jr4A7YGSECByCszjrweVwSpuPgv4EslTXh8dekEAB1zBuhEsnIUTWgp8et:jr4A8GHCc/yhEslTXh8vEZnNTWW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\wndr.cat
- Size 12KB
- SHA256 7f784e9ffd1ea2e8b19ed583db8d395d643186a7f930234ee69fd71dcc208f3b
- MD5 5d61437ee311a8aedc5af1d92b520a23
- SHA1 4411b26ed712a63a6dd15d909e7c6c6d29d49400
- SHA512 d0b1c5961e067693729546502255e91721e4a97e5413e76e9f19d73e774ff3f55ad89713f3b643c88e096958103536d600ef768e3eeca2d8a2b858b3953a8ff8
- SSDEEP 192:EeBzBlo+vNJC41yrEEw5EYhYCs+xgB6gqzGslX01k9z3AeygLKuFaE5:b71yYh3s/kGER9zOfQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\normal.ico
- Size 194KB
- SHA256 3c75eaa4dc66bc1cab8324f14a2f54a62a44ee050a7a6e925592921ebb48f8f5
- MD5 9fd1679643ee825d340f58471a869fde
- SHA1 2ac5b4f383d5fa10ad3fbbb30c6fe0654c8b8039
- SHA512 d1a4cb08415493f7b10a6edb45f2fe30c7e4d8cb77fe29143887edaac5bf992146df61c412016c687ef4dd9e1b181c7328c0811314e3ebec7f19798cb5e75a79
- SSDEEP 3072:/ebumSpSMe7B1f9mehJlBWz+Q/rKmS9q28oAhY:WSpJe7B18uQ/rKmSv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\main.ico
- Size 422KB
- SHA256 ecb25a772f8e3db7027850aa646384d37190d9233dec18a9151201b0acb20c69
- MD5 e7065376abcdb34c3147162172c29ea7
- SHA1 4608d48bb5476823116db94a0890f52f559eca39
- SHA512 7119480da0cc16a7609a611c984c888589c722edc9d5d213a488b11426020a92402ea06be0a375bb2912661d73caa06d4a52243b8233fdec64af1f056a8b44c2
- SSDEEP 12288:QQrmuEmjHLzMA2YcrGfraQTJAA5ZHIFAKVxAXAL6OQGJpAbHABo88tAGjzVnnV69:JrmuEmjHLzMA2YcrGfraQTJAA5ZHIFAW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
- Size 89B
- SHA256 0250fb5859894a3e013c3fe28e16b85fa54e88b0a6a7e9ba99f9be3cbbaaa9d4
- MD5 222551cb2e469a87c1972e5e66b2080f
- SHA1 b6522a05128622197dd3bcef677dd2ee2d131c93
- SHA512 6e3795f3aa9a37437b382f0f465a5751e57377d922bc837ab229d2475862bb26a5358ca8b48edc079536fceca8fcc2759947bb0310ff2a657ce268c34efd1a63
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
- Size 330B
- SHA256 a7d07fb60464b4f19c67203b4fa5101ab759596963d2083822570de5c3166584
- MD5 8039c071c563590a2cb23d85966a3a8d
- SHA1 73fea27243d487edbc823b223666157b02bc5624
- SHA512 5cdc064bd84dc77c292cdda42508a4fe151f4e93f885aea148bb7e67cd3714044dc71ee40b75692ae66f42b8afa08d9115a650b2ff3709644f7858affddddce7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\802rd848\dhjk.bce
- Size 11.5MB
- SHA256 f8683fa3e248cc7dfd17d541dde23366d5b05112b30442aba033abd671cc2524
- MD5 ec8eda88ce80e96d2c8110e8e9e46adf
- SHA1 05607645a64283d92cd34e28873494d274798719
- SHA512 9ee23e2d5d5d5ce0e5a2d3b592cfc1bec1876dec605ccdbb7e4e5f74a9099948f9c0842a7506c9eafb9be90b12fe8b5eaa0267a51f496f8c6bc58adc9cd5e730
- SSDEEP 196608:UKyWq+VeRsiFeUmPur7uRRL3gIzTUSuTagprefQ09+Jtgg1dKTkDse1oycNH041F:UKW+Ls+PbRJzTpgagprefQ5zg4Mq6Ug3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sr2mbhbd.lll.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\uyuvav.exe
- Size 97KB
- SHA256 538ef69041e4cd241babc92e40bce792ca3de57f048897b9072addf6223d730e
- MD5 ff8e2d576ca9914af0d6daf056a8203e
- SHA1 cf785c80117568bf4c626690f63fcc1d750e97de
- SHA512 2135dc290e30b8dd1fee1afd5e4654b126e5e34bfb762c1e3980ab3b2a09427e5b762bd363e89c01ac8910dae350bddc53acda0a3c52852d96ff5f06c9d64af5
- SSDEEP 1536:mXhpMU0GTlfgjtdllxVG8IpyLkpvEZOYEGmh/dH3FlBb0PO45v:an96bc8oyLkpMZOYZgJ1lBe3v
- MD5 SHA1 SHA512 SSDEEP