| File name: | SecuriteInfo.com.FileRepMalware.24944.22163 |
| Full analysis: | https://app.any.run/tasks/da09eca7-e167-46e8-acdc-7182d83e5892 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | February 13, 2025, 03:37:56 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
| MD5: | D6F928B3064FC7ADD48780D202563F84 |
| SHA1: | CBB71D2D4594E1472F468CBD20C6205C3A0238AC |
| SHA256: | F935FC46795BE21D35C7B7E797777BF689B5CB0CD1194E4F9B0EA9FACD134613 |
| SSDEEP: | 24576:Izbz1GADM9Zqn6XZF+34ga3jqheqJfL7mEBwpZvzsbGhts3rbBqo011j:kbz1GADM9Zqn6XZF+o/3jqheqJL7mEBo |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- nz_shokz.exe (PID: 6632)
- nz_shokz.exe (PID: 6564)
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
- nz_shokz.exe (PID: 6832)
Reads Microsoft Outlook installation path
- nz_shokz.exe (PID: 6564)
- nz_shokz.exe (PID: 6832)
Reads Internet Explorer settings
- nz_shokz.exe (PID: 6564)
- nz_shokz.exe (PID: 6832)
Malware-specific behavior (creating "System.dll" in Temp)
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
The process creates files with name similar to system file names
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
Creates a software uninstall entry
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
Executable content was dropped or overwritten
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
Process requests binary or script from the Internet
- nz_shokz.exe (PID: 6832)
Checks Windows Trust Settings
- nz_shokz.exe (PID: 6832)
INFO
Checks supported languages
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
- nz_shokz.exe (PID: 6572)
- nz_shokz.exe (PID: 6564)
- nz_shokz.exe (PID: 6632)
- nz_shokz.exe (PID: 6832)
The sample compiled with chinese language support
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
Reads the computer name
- nz_shokz.exe (PID: 6564)
- nz_shokz.exe (PID: 6632)
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
- nz_shokz.exe (PID: 6832)
Checks proxy server information
- nz_shokz.exe (PID: 6632)
- nz_shokz.exe (PID: 6564)
- nz_shokz.exe (PID: 6832)
Create files in a temporary directory
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
Creates files or folders in the user directory
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
- nz_shokz.exe (PID: 6632)
- nz_shokz.exe (PID: 6832)
Process checks computer location settings
- SecuriteInfo.com.FileRepMalware.24944.22163.exe (PID: 6492)
Reads the software policy settings
- nz_shokz.exe (PID: 6832)
Reads the machine GUID from the registry
- nz_shokz.exe (PID: 6832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | NSIS - Nullsoft Scriptable Install System (94.8) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (3.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (0.7) |
| .exe | | | Win32 Executable (generic) (0.5) |
| .exe | | | Generic Win/DOS Executable (0.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2009:12:05 22:50:46+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 23552 |
| InitializedDataSize: | 119808 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x323c |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.0.0.0 |
| ProductVersionNumber: | 3.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Windows, Chinese (Simplified) |
| CompanyName: | 三七互娱（上海）科技有限公司 |
| FileDescription: | 战国之怒 install |
| FileVersion: | 3.0.0.0 |
| LegalCopyright: | 三七互娱（上海）科技有限公司 |
| ProductName: | 战国之怒 |
Total processes
129
Monitored processes
6
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6364 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.24944.22163.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.24944.22163.exe | — | explorer.exe | |||||||||||
User: admin Company: 三七互娱（上海）科技有限公司 Integrity Level: MEDIUM Description: 战国之怒 install Exit code: 3221226540 Version: 3.0.0.0 Modules
| |||||||||||||||
| 6492 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.24944.22163.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.24944.22163.exe | explorer.exe | ||||||||||||
User: admin Company: 三七互娱（上海）科技有限公司 Integrity Level: HIGH Description: 战国之怒 install Exit code: 0 Version: 3.0.0.0 Modules
| |||||||||||||||
| 6564 | "C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe" SW_SHOWNORMAL | C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe | SecuriteInfo.com.FileRepMalware.24944.22163.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: 战国红颜 Exit code: 0 Version: 3, 0, 0, 0 Modules
| |||||||||||||||
| 6572 | "C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe" /ShowDeskTop | C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe | — | SecuriteInfo.com.FileRepMalware.24944.22163.exe | |||||||||||
User: admin Integrity Level: HIGH Description: 战国红颜 Exit code: 0 Version: 3, 0, 0, 0 Modules
| |||||||||||||||
| 6632 | "C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe" /setupsucc | C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe | SecuriteInfo.com.FileRepMalware.24944.22163.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: 战国红颜 Exit code: 0 Version: 3, 0, 0, 0 Modules
| |||||||||||||||
| 6832 | "C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe" /autorun /setuprun | C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe | SecuriteInfo.com.FileRepMalware.24944.22163.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: 战国红颜 Version: 3, 0, 0, 0 Modules
| |||||||||||||||
Total events
2 570
Read events
2 553
Write events
17
Delete events
0
Modification events
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C000000000000046910200006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Õ½¹ú֮Š|
| Operation: | write | Name: | DisplayName |
Value: Õ½¹ú֮Š| |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Õ½¹ú֮Š|
| Operation: | write | Name: | UninstallString |
Value: C:\Users\admin\AppData\Roaming\nz_shokz\uninst.exe | |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Õ½¹ú֮Š|
| Operation: | write | Name: | DisplayIcon |
Value: C:\Users\admin\AppData\Roaming\nz_shokz\nz_shokz.exe | |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Õ½¹ú֮Š|
| Operation: | write | Name: | DisplayVersion |
Value: 3.0.0.0 | |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Õ½¹ú֮Š|
| Operation: | write | Name: | URLInfoAbout |
Value: http://www.37.com/ | |||
| (PID) Process: | (6492) SecuriteInfo.com.FileRepMalware.24944.22163.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Õ½¹ú֮Š|
| Operation: | write | Name: | Publisher |
Value: ÈýÆß»¥Ó飨ÉϺ££©¿Æ¼¼ÓÐÏÞ¹«Ë¾ | |||
| (PID) Process: | (6564) nz_shokz.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6564) nz_shokz.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
8
Suspicious files
28
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6492 | SecuriteInfo.com.FileRepMalware.24944.22163.exe | C:\Users\admin\AppData\Local\Temp\nsd6BCF.tmp\FindProcDLL.dll | executable | |
MD5:8614C450637267AFACAD1645E23BA24A | SHA256:0FA04F06A6DE18D316832086891E9C23AE606D7784D5D5676385839B21CA2758 | |||
| 6492 | SecuriteInfo.com.FileRepMalware.24944.22163.exe | C:\Users\admin\AppData\Roaming\nz_shokz\uninst.exe | executable | |
MD5:98F8D8728C3C1EE7B8E5C6C4D365FBD7 | SHA256:DD92176FB9EB56A880DB41BDC19B41834F330F1864AD435F4123F73CAE9CC823 | |||
| 6492 | SecuriteInfo.com.FileRepMalware.24944.22163.exe | C:\Users\admin\AppData\Local\Temp\nsn6BBE.tmp | binary | |
MD5:BEA8963FE7E9E57A19081E8A704139DF | SHA256:B749EED2BA515A42A18C6F79048541AB88C5E99DFD7E4AC1AE2E0706F48474CE | |||
| 6492 | SecuriteInfo.com.FileRepMalware.24944.22163.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Õ½¹úÖ®Å.lnk | binary | |
MD5:3B6967B1C1E2AA7DB9C83B74ADE98EC2 | SHA256:7DD92961DD1A659ADABAAD43DA7EF288CD9972F4206122FC62335626B76FA37E | |||
| 6492 | SecuriteInfo.com.FileRepMalware.24944.22163.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\37ÓÎÏ·ÖÐÐÄ\Õ½¹úÖ®Å\Õ½¹úÖ®Å.lnk | binary | |
MD5:1879FDED323C53175A4CE67AD26F7EDE | SHA256:96627C63A56F0FE1FED4FC6A213F6C0A8F254BC599A6D87D81FBE6ACF52148BF | |||
| 6492 | SecuriteInfo.com.FileRepMalware.24944.22163.exe | C:\Users\admin\Desktop\Õ½¹úÖ®Å.lnk | binary | |
MD5:41172F82DD684F8381760665D53E3DCE | SHA256:5ACB2EBCE561580EABF922181C7506C60954AAC751EF297C92859D367252B92D | |||
| 6832 | nz_shokz.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\client[1].htm | html | |
MD5:4F3241F6BF15D3BF5A164989AB851B14 | SHA256:5CD20919CFD539B4D93D4E6B7FC8803E399079C3236920B2ACA01D12B43612A4 | |||
| 6832 | nz_shokz.exe | C:\Users\admin\AppData\Roaming\nz_shokz\Upgrade\app.ini | text | |
MD5:59AB193BEF60259BCF88E9B323EECA3C | SHA256:DBBCFF6A684995E02FCA1CAD9CE914D1E48586B75BEFE044D5B8E42FDD15A156 | |||
| 6832 | nz_shokz.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\210933144YHms[1].jpg | binary | |
MD5:BBB69DABEDAF8BB1928F27414710FBA0 | SHA256:30F0BB3B8BD26537EB113611204A5306A02DAB8B0BDA74BAE8D2067DAFF2CB75 | |||
| 6832 | nz_shokz.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\app[1].ini | text | |
MD5:59AB193BEF60259BCF88E9B323EECA3C | SHA256:DBBCFF6A684995E02FCA1CAD9CE914D1E48586B75BEFE044D5B8E42FDD15A156 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
49
DNS requests
29
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 92.122.225.232:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 96.6.17.223:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6832 | nz_shokz.exe | GET | 200 | 138.113.27.66:80 | http://d.wanyouxi7.com/yx/zg/sqcs/917447/app.ini | unknown | — | — | unknown |
6832 | nz_shokz.exe | GET | 200 | 113.219.195.78:80 | http://img2.37wanimg.com/2015/10/210933144YHms.jpg | unknown | — | — | unknown |
6832 | nz_shokz.exe | GET | 200 | 111.174.12.90:80 | http://ptres.37.com/js/sq/widget/sq.login.js?t=20230803101600 | unknown | — | — | whitelisted |
6832 | nz_shokz.exe | GET | 200 | 111.174.12.90:80 | http://ptres.37.com/js/sq/lib/sq.core.js?t=20140304 | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6832 | nz_shokz.exe | GET | 200 | 111.174.12.90:80 | http://img1.37wanimg.com/zg/css/client/game.css?t=1739417893 | unknown | — | — | unknown |
6832 | nz_shokz.exe | GET | 200 | 111.174.12.90:80 | http://img1.37wanimg.com/zg/js/client/game.js?t=1739417893 | unknown | — | — | unknown |
6832 | nz_shokz.exe | GET | 200 | 111.174.12.90:80 | http://ptres.37.com/js/sq/widget/sq.tab.js | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
444 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
900 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 92.122.225.232:80 | crl.microsoft.com | TELECOM ITALIA SPARKLE S.p.A. | IT | whitelisted |
5064 | SearchApp.exe | 104.126.37.145:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 96.6.17.223:80 | www.microsoft.com | AKAMAI-AS | NO | whitelisted |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6632 | nz_shokz.exe | 106.55.79.146:80 | a.clickdata.37wan.com | Shenzhen Tencent Computer Systems Company Limited | CN | unknown |
6564 | nz_shokz.exe | 193.112.84.233:80 | gameapp.37.com | Shenzhen Tencent Computer Systems Company Limited | CN | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
a.clickdata.37wan.com |
| unknown |
gameapp.37.com |
| whitelisted |
img1.37wanimg.com |
| unknown |
img2.37wanimg.com |
| unknown |