Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026.08.11裁员名单及补偿方案WPS.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026.08.11裁员名单及补偿方案WPS.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026.08.11裁员名单及补偿方案WPS.exe
- Size 3.5MB
- Sample260814-ftdppsvgmc
- SHA256 660f64f23e62776bcd462039d34cb9511f3634378c4e7b70a03aec2a2ac787bc
- MD5 0079ab541b10ef2ce429c08c0c7585da
- SHA1 758c487eb54b5cd0d7cda833504ed0fbbe070a73
- SHA512 6709b13f8772986de65df236e9c8a5e77c1aa78ba552d401697ee073e9655e250922fb8a035eacf6418a4b066d61300b6d00a46392f2f6651bf1d3d27ae7b536
- SSDEEP 49152:5mVd2RbhCuzVcJez7ZIkJh53J8PF1K/oJsv6tWKFdu9CgPTvG7FqOqRsjfJXcRWh:rb1QNJsv6tWKFdu9Cgiiix
- TLSH T12CF58D87B2F61364D9B7C134C6E7A16ADA317C428F60A9CF125CB7195A736F01E3B218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 2026.08.11裁员名单及补偿方案WPS.exe 1916 2026.08.11裁员名单及补偿方案WPS.exe 4832 2026.08.11裁员名单及补偿方案WPS.exe 4832 2026.08.11裁员名单及补偿方案WPS.exe 4832 2026.08.11裁员名单及补偿方案WPS.exe 4832 2026.08.11裁员名单及补偿方案WPS.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe 4108 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4832 2026.08.11裁员名单及补偿方案WPS.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1916 2026.08.11裁员名单及补偿方案WPS.exe Token: SeDebugPrivilege 1916 2026.08.11裁员名单及补偿方案WPS.exe Token: SeDebugPrivilege 4832 2026.08.11裁员名单及补偿方案WPS.exe Token: SeDebugPrivilege 4832 2026.08.11裁员名单及补偿方案WPS.exe Token: SeDebugPrivilege 4108 svchost.exe Token: SeDebugPrivilege 4108 svchost.exe Token: SeDebugPrivilege 4108 svchost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1676 1916 2026.08.11裁员名单及补偿方案WPS.exe 25 PID 1916 wrote to memory of 4832 1916 2026.08.11裁员名单及补偿方案WPS.exe 89
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\2026.08.11裁员名单及补偿方案WPS.exe"C:\Users\Admin\AppData\Local\Temp\2026.08.11裁员名单及补偿方案WPS.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2026.08.11裁员名单及补偿方案WPS.exe"C:\Users\Admin\AppData\Local\Temp\2026.08.11裁员名单及补偿方案WPS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4832
-