Analysis date (UTC): 9 April 2025, 19:35Analysis environment: Windows 10 Pro, build 19044, x64

wildepoch.io

MD5:D5A884F350BCA1CE752E8046E50FAA88

SHA1:30B118E8E2BC76314F65A1C6988E8B5F5DCFA761

SHA256:B7B3AC6F9B7E023591C9AF22272A6B272F50D8658733434F8470019FC81E2533

Analysis result

Threat level:Malicious activity

Full analysis:Analysis wildepoch.io Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes Windows Defender settings

Game_WildEpoch.exe (PID: 2552)

Adds path to the Windows Defender exclusion list

Game_WildEpoch.exe (PID: 2552)

Changes powershell execution policy (Bypass)

Game_WildEpoch.exe (PID: 2552)

Bypass execution policy to execute commands

powershell.exe (PID: 2564)
powershell.exe (PID: 6416)

Adds process to the Windows Defender exclusion list

Game_WildEpoch.exe (PID: 2552)

Adds extension to the Windows Defender exclusion list

Game_WildEpoch.exe (PID: 2552)

Run PowerShell with an invisible window

powershell.exe (PID: 6416)

Downloads the requested resource (POWERSHELL)

powershell.exe (PID: 6416)
powershell.exe (PID: 780)

Dynamically loads an assembly (POWERSHELL)

powershell.exe (PID: 780)

SUSPICIOUS

Reads security settings of Internet Explorer

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)

Reads Microsoft Outlook installation path

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)

Reads Internet Explorer settings

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 2552)
Game_WildEpoch.exe (PID: 1052)

The process hide an interactive prompt from the user

Game_WildEpoch.exe (PID: 2552)

Starts POWERSHELL.EXE for commands execution

Game_WildEpoch.exe (PID: 2552)
mshta.exe (PID: 3008)

Script adds exclusion path to Windows Defender

Game_WildEpoch.exe (PID: 2552)

Script adds exclusion extension to Windows Defender

Game_WildEpoch.exe (PID: 2552)

Script adds exclusion process to Windows Defender

Game_WildEpoch.exe (PID: 2552)

Executable content was dropped or overwritten

Game_WildEpoch.exe (PID: 2552)

The process bypasses the loading of PowerShell profile settings

Game_WildEpoch.exe (PID: 2552)

Possibly malicious use of IEX has been detected

Game_WildEpoch.exe (PID: 2552)
mshta.exe (PID: 3008)

Executes script without checking the security policy

powershell.exe (PID: 6416)

The process executes via Task Scheduler

mshta.exe (PID: 3008)

Uses base64 encoding (POWERSHELL)

powershell.exe (PID: 6416)
powershell.exe (PID: 780)

INFO

The sample compiled with english language support

chrome.exe (PID: 1132)

Reads the software policy settings

slui.exe (PID: 8132)
Game_WildEpoch.exe (PID: 5204)
slui.exe (PID: 5384)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)

Application launched itself

chrome.exe (PID: 7296)

Manual execution by a user

regedit.exe (PID: 2064)
regedit.exe (PID: 3968)
regedit.exe (PID: 8128)
regedit.exe (PID: 5800)

Checks proxy server information

slui.exe (PID: 5384)
Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)
powershell.exe (PID: 6416)
mshta.exe (PID: 3008)

Executable content was dropped or overwritten

chrome.exe (PID: 1132)
chrome.exe (PID: 7296)

Create files in a temporary directory

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 2552)
Game_WildEpoch.exe (PID: 1052)

Creates files in the program directory

Game_WildEpoch.exe (PID: 5204)

Checks supported languages

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)

Reads the computer name

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)

Reads the machine GUID from the registry

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 1052)
Game_WildEpoch.exe (PID: 2552)

Autorun file from Downloads

chrome.exe (PID: 236)

Creates files or folders in the user directory

Game_WildEpoch.exe (PID: 5204)
Game_WildEpoch.exe (PID: 2552)

Checks if a key exists in the options dictionary (POWERSHELL)

powershell.exe (PID: 2564)
powershell.exe (PID: 7868)
powershell.exe (PID: 6540)
powershell.exe (PID: 3304)
powershell.exe (PID: 2064)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 7868)
powershell.exe (PID: 6540)
powershell.exe (PID: 2064)
powershell.exe (PID: 3304)

Process checks computer location settings

Game_WildEpoch.exe (PID: 2552)

Disables trace logs

powershell.exe (PID: 6416)

Reads Internet Explorer settings

mshta.exe (PID: 3008)

Threats

PID	Process	Class	Message
7520	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7520	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7520	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7520	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)