Analysis
- max time kernel
299s - max time network
280s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/09/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026.09.15裁员名单及补偿方案WPS.exe
Resource
win11-20260911-en
windows11-21h2-x64
7 signatures
300 seconds
General
- Target 2026.09.15裁员名单及补偿方案WPS.exe
- Size 206KB
- Sample260916-nykb2sty2l
- SHA256 d13606b6d2f3a9625d4c2294b5cb517c6250b9a9b7b0f40ac4fcc73ca3005c78
- MD5 3a9a55b6669f56bc6ed97d08cf8785ed
- SHA1 42421e2d6eb0b57e294ad152e560afb1074eb6cc
- SHA512 7fa8fc2ff5edaaf5cfe16eeb2780e2a3f54f8ba0d0e345ba32b4096c5985962139b44c95e698b7b3cdb9e08018599309b97f5d5e68be6e16e480344a44d6e551
- SSDEEP 6144:ea8ZEtBszFdak2KSzjM+T3ISx1bnsvzLNDAKgy:hHEP
- TLSH T12E240914BA336278D26FEC77C1C1A779FA713846ABD521CB67E05E724E712709E36280
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 svchost.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe 4364 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 576 2026.09.15裁员名单及补偿方案WPS.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 576 2026.09.15裁员名单及补偿方案WPS.exe Token: SeDebugPrivilege 4364 svchost.exe Token: SeDebugPrivilege 4364 svchost.exe Token: SeDebugPrivilege 4364 svchost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 576 wrote to memory of 1232 576 2026.09.15裁员名单及补偿方案WPS.exe 20
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Users\Admin\AppData\Local\Temp\2026.09.15裁员名单及补偿方案WPS.exe"C:\Users\Admin\AppData\Local\Temp\2026.09.15裁员名单及补偿方案WPS.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576