WezoAutoUP.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | June 21, 2024, 9:45 a.m. | June 21, 2024, 9:47 a.m. |
-
-
-
-
ipconfig.exe ipconfig
2328
-
-
-
WezoEventUP.exe C:\Users\test22\AppData\Local\Temp\WezoEventUP.exe
2412 -
-
7z.exe C:\Users\test22\AppData\Local\Temp\7z.exe x -y D:\verysync-windows-amd64-v2.15.0.zip -od:\
2628
-
-
DelHosts.exe C:\Users\test22\AppData\Local\Temp\DelHosts.exe
2764 -
wzoptup.exe C:\Users\test22\AppData\Local\Temp\wzoptup.exe
2856 -
storyhosts.exe C:\Users\test22\AppData\Local\Temp\storyhosts.exe
2944 -
sysup.exe C:\Users\test22\AppData\Local\Temp\sysup.exe
3028 -
dbzclientUpdate.exe C:\Users\test22\AppData\Local\Temp\dbzclientUpdate.exe
2148 -
wzoptBmp.exe C:\Users\test22\AppData\Local\Temp\wzoptBmp.exe
2332 -
changezuhaolnk.exe C:\Users\test22\AppData\Local\Temp\changezuhaolnk.exe
2852
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dl-cn.verysync.com | 104.21.52.166 | |
| wieie.cn | 58.23.215.23 |
Suricata Alerts
Suricata TLS
No Suricata TLS
| packer | UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser |
| request | GET http://dl-cn.verysync.com/releases/v2.15.0/verysync-windows-amd64-v2.15.0.zip |
| request | GET http://dl-cn.verysync.com/releases/ |
| file | C:\Users\test22\AppData\Local\Temp\storyhosts.exe |
| file | C:\Users\test22\AppData\Local\Temp\7z.exe |
| file | C:\Users\test22\AppData\Local\Temp\DownVerySync.exe |
| file | C:\Users\test22\AppData\Local\Temp\changezuhaolnk.exe |
| file | C:\Users\test22\AppData\Local\Temp\dbzclientUpdate.exe |
| file | C:\Users\test22\AppData\Local\Temp\WezoEventUP.exe |
| file | C:\Users\test22\AppData\Local\Temp\7z.dll |
| file | C:\Users\test22\AppData\Local\Temp\wzoptup.exe |
| file | C:\Users\test22\AppData\Local\Temp\DelHosts.exe |
| file | C:\Users\test22\AppData\Local\Temp\sysup.exe |
| file | C:\Users\test22\AppData\Local\Temp\wzoptBmp.exe |
| file | C:\Users\test22\AppData\Local\Temp\arpwriteIni.exe |
| cmdline | C:\Windows\system32\cmd.exe /c ipconfig |
| file | C:\Users\test22\AppData\Local\Temp\wzoptup.exe |
| file | C:\Users\test22\AppData\Local\Temp\arpwriteIni.exe |
| file | C:\Users\test22\AppData\Local\Temp\7z.dll |
| file | C:\Users\test22\AppData\Local\Temp\storyhosts.exe |
| file | C:\Users\test22\AppData\Local\Temp\sysup.exe |
| file | C:\Users\test22\AppData\Local\Temp\7z.exe |
| file | C:\Users\test22\AppData\Local\Temp\WezoEventUP.exe |
| file | C:\Users\test22\AppData\Local\Temp\dbzclientUpdate.exe |
| file | C:\Users\test22\AppData\Local\Temp\wzoptBmp.exe |
| file | C:\Users\test22\AppData\Local\Temp\DelHosts.exe |
| section | {u'size_of_data': u'0x0004aa00', u'virtual_address': u'0x0007d000', u'entropy': 7.940965856094214, u'name': u'UPX1', u'virtual_size': u'0x0004b000'} | entropy | 7.94096585609 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.911450381679 | description | Overall entropy of this PE file is high | |||||||||||
| process | cmd.exe |
| section | UPX0 | description | Section name indicates UPX | ||||||
| section | UPX1 | description | Section name indicates UPX | ||||||
| cmdline | ipconfig |
| cmdline | C:\Windows\system32\cmd.exe /c ipconfig |
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WezoAotoUp | reg_value | "C:\Users\test22\AppData\Local\Temp\WezoAutoUP.exe" | ||||||
| file | C:\Users\test22\AppData\Local\Temp\changezuhaolnk.exe |
| file | C:\Users\test22\AppData\Local\Temp\storyhosts.exe |
| cmdline | C:\Users\test22\AppData\Local\Temp\DownVerySync.exe |
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Multi.Generic.lrP4 |
| Elastic | malicious (moderate confidence) |
| Cynet | Malicious (score: 99) |
| Skyhigh | BehavesLike.Win32.AutoitDropper.fc |
| Cylance | Unsafe |
| Sangfor | Trojan.Win32.Agent.V6xa |
| K7AntiVirus | Trojan ( 0056e5201 ) |
| K7GW | Trojan ( 0056e5201 ) |
| VirIT | Trojan.Win32.Generic.XTX |
| Symantec | Trojan.Gen.MBT |
| ESET-NOD32 | multiple detections |
| APEX | Malicious |
| McAfee | RDN/YahLover.worm |
| Avast | Win32:Evo-gen [Trj] |
| ClamAV | Win.Malware.Generic-6651791-0 |
| Kaspersky | UDS:DangerousObject.Multi.Generic |
| Alibaba | Packed:Win32/Generic.4fad0b70 |
| F-Secure | Dropper.DR/AutoIt.Gen |
| DrWeb | Trojan.Siggen5.59949 |
| TrendMicro | TROJ_GEN.R002C0PET24 |
| McAfeeD | ti!82A9537D99A9 |
| Trapmine | malicious.high.ml.score |
| FireEye | Generic.mg.46748aff6fcab034 |
| Sophos | Mal/Generic-S |
| Ikarus | PUA.Autoit |
| Webroot | W32.Trojan.Gen |
| Detected | |
| Avira | DR/AutoIt.Gen |
| Antiy-AVL | Trojan[Packed]/Win32.Autoit |
| Kingsoft | Win32.Troj.Unknown.a |
| Gridinsoft | Trojan.Win32.CoinMiner.dd!s2 |
| Xcitium | TrojWare.Win32.Hider.REXR@5364l6 |
| Microsoft | Trojan:Win32/Casdet!rfn |
| ViRobot | Trojan.Win32.A.Agent.690283[UPX] |
| ZoneAlarm | UDS:DangerousObject.Multi.Generic |
| GData | Win32.Trojan.PSE.R2WKDE |
| Varist | W32/Trojan.IJBN-1595 |
| DeepInstinct | MALICIOUS |
| VBA32 | IMWorm.Sohanad |
| Malwarebytes | Generic.Malware.AI.DDS |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | TROJ_GEN.R002C0PET24 |
| Tencent | Autoit.Trojan.Autoit.Gajl |
| Yandex | Trojan.GenAsa!i9rai7w7/WE |
| MaxSecure | Trojan.Malware.204083740.susgen |
| Fortinet | Riskware/YahLover |
| AVG | Win32:Evo-gen [Trj] |
| Paloalto | generic.ml |
| CrowdStrike | win/malicious_confidence_100% (W) |