Malware Analysis Report

2025-01-02 15:26

Sample ID 240525-tebhpaac38
Target b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb
SHA256 b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb
Tags
gh0strat purplefox persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb

Threat Level: Known bad

The file b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

PurpleFox

Gh0st RAT payload

Gh0strat

Drops file in Drivers directory

Sets service image path in registry

Sets DLL path for service in the registry

Loads dropped DLL

UPX packed file

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-25 15:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 15:57

Reported

2024-05-25 16:00

Platform

win7-20240221-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259419912.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\259419912.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddf9d99692d21e46b898d7f4e19017d500000000020000000000106600000001000020000000d769a9e9221292cd1d7981319dad8b046f2b4d976c90bd24e2ef39097420a330000000000e80000000020000200000005ac2874d3c5534642aa7e04d0f74e6c125f8f5097703558e34e849233410ffbe200000000cd1ab449addce655fefc3101210d5118566c9ab404e21bd8b65e3f002e465fd4000000054dad74b36ebc379ea2dcfaf14df5d0f1f84683b40736591cca90c1efdf50d695bf04d6f1ec632eab9a277ff2e579c319d06c6fc5fe7a7cb4d08d974d577960a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a48566bcaeda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddf9d99692d21e46b898d7f4e19017d500000000020000000000106600000001000020000000ab34e3bfb71d95dc7f4104a87346b6d3e87729c05e92c6e82f7c2cc3d48b6604000000000e8000000002000020000000fbabc0cf9018e5ce41702588cea01fb9f8d9afcbd910d594fe8845743d9c5a9e90000000917e74e91007a4bcd9a8e8c7d4f034a0b78e03515137490a58903adced6bfcc686b5b4f4a2cff4e3fa272d724cef9fd3c6581909b78e6fcb186522adee8bf367364e5d884c635a5b14be65e5e5f48dc679e72487f831c9450138b84a0a425ede3a99050cdd18272d969c90cde268cb334e160ab2ffb724c1bc64adcb016f0d66b9ecfb7f7b98c0d155eeef56c3baa455400000006fbd514910131b1f32747e5b1a08c9c057837213f31700dc9b73442aec053cd7627d8a758027c11e0d83915439b89c27e78bb10e54c8fb6bbfd660c0ddbb4590 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422814548" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EE72A41-1AAF-11EF-A692-6A83D32C515E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3024 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2208 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 3024 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 3024 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 3024 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2536 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2536 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2536 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2536 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3024 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe
PID 3024 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe
PID 3024 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe
PID 3024 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe
PID 2484 wrote to memory of 2256 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2484 wrote to memory of 2256 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2484 wrote to memory of 2256 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2484 wrote to memory of 2256 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 1708 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1708 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1708 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1460 wrote to memory of 1480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1460 wrote to memory of 1480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1460 wrote to memory of 1480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1460 wrote to memory of 1480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

"C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259419912.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://pc.weixin.qq.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 pc.weixin.qq.com udp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
US 163.181.154.233:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 res.wx.qq.com udp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
US 163.181.154.233:80 ocsp.digicert.cn tcp
US 163.181.154.233:80 ocsp.digicert.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/2208-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2208-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2628-18-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/2628-26-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\259419912.txt

MD5 faf3f34e723aba381f7f4d43b7dc4f40
SHA1 b4fb808bbc51c07c6369546e78d03efbeab54410
SHA256 a92488b8b46ef72e178d693838b8dbecc1bc27d2fbe9c92c75a53618b1632fcb
SHA512 f571ecc94ffbd4dba188a72dae7aeb2e45d6e8ea6a7f597cab5b171edab3c4f8cfefd168db522291c5073e7f34908600b727bac292c5ce90b54a55d73df5023c

memory/2528-31-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2528-34-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2528-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2528-35-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2528-38-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

MD5 75f9bbc35802ae5cf0215c0ebbfa7390
SHA1 81c85fb9906c1fe95399ee19210d15d6ad4ba0f4
SHA256 2f69433df55a5e5ca40a37a40334d4fe085d1d420c50bbefc00b3eb7cd5e26f7
SHA512 4eb88bb9f2a3e1aa5d99c6e1ca6e50ab9327640388652af45a053111dd197e883541a300dbf1dce30d941eac789b4081ea066a307ddbba75e2cf2b35f4601cf5

memory/2528-50-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 239aa557c50920d5b084fad8f3c40867
SHA1 5a72500c38b4c1fd633791a7b5604d2dbc7c3fd2
SHA256 223723c3c853c4f387caebaf1a5caa8428c5683fd603bc8a6af8527c2dc3c1f6
SHA512 3e2ea3d00af49e15aa83ad30236205cda1b2bb9cbe18ccddcbb8175e7b09a10e1a23f5a8be82912298ceccf95026028b56499cd7a5a82b744280653d9a183d79

\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d04a7d20e63833332a2dd9ec18a4917a
SHA1 4e4fe003450ace30057de5b9aa1aa307e7354cd7
SHA256 b9fa75aa6aa439e2d5b9612566a7abcb3a136272ef0124a04e81faf7a8509f7e
SHA512 0ed5c4c6416bf2ebfa1e711aef22f25b209387c84bddeca3c4576617f33f446f7199c5a7f26d2e9567cef527054abbb7d21ff62d0fefb7ded4a4e83112c59346

C:\Users\Admin\AppData\Local\Temp\CabAE7B.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarAE7C.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\CabAF86.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\TarAFF8.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8073fd9b209928216ce1255775faad2a
SHA1 02b55d38cdad3b49e4e32135471ee1b492d6505a
SHA256 8480e0e81ed6dce58a5943913e45253aaba2493d88e180d796cfec6759820802
SHA512 a8c3dfc8563ecdb8887a806416023a9d35ae5cc1d4dc045885327a3cbe47334bbf882ef03f1b310280a8409f19bdc6351de373250d6ec37978a5716d5065b140

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ea792326ed12797b0ab55c853baffdc
SHA1 db004635b3555e54718e64d08b082f5dab0b9f38
SHA256 80d16cbb810546ae0290e2d5dd69e2c651825bff393cb54e1afc9cdba7c163d5
SHA512 ac4925920cf01d32c86cf7c129a8d2916a29db276dc4037521368495de4308ebc843e17fe8538b202236b56d34f141709d4e03702a926a407b3e9d4c6495186a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d552c42ec9bb3e9ba960c855f916047
SHA1 579d54936c18818433926653ed297aa228bce51d
SHA256 6de0d9451946acf11f7014eb9a70f55161735774093a9ff7021899e835e1e9c4
SHA512 7d7ce36a85617e02079b032393085262ad30c40523964e9e2dd8dd87c4f50715f910cdfce4fe06910688cadb17289a643ad58122f7f51f39769be4858d5d4f03

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fbb031e6445c665b1045d3e1a6a1cfc1
SHA1 a8570438e0f06658b13dc86a5165cd7e7c495aae
SHA256 28806b64a421455096dc5c2957e2d239b1d6fa5b632c780b816d00925ee519e7
SHA512 1c34dc3f665c4683add5048194d899fdc29b4a12f2aa0721b3aa923858801ae8b6c9f5f1dfe50ddfd7df067408f8290b012db3a848e10b6da2078bdee14d7e50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b36e62b3a028ea655c1e8816e12ab0f2
SHA1 b69bdb5c0471a857612609cb589621a163fcf3c0
SHA256 889738c97e6e0e232ab4a42990cbf3e70ae00dd094b7393eb8c6fef42dc71bfb
SHA512 c8f7463186c7adbdcf2fb5b38bffb9fb69ec18e0044978e14a202e22d60d5b7e9b1c7af7b6e4bd8673f17e9e7367d1b37892e3c33dd1a5cfa67b9460145014a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 34e8b920fc011688636c5496908290a7
SHA1 70982fc96e11ed12a0e9c7c2964dd6b35ad6008b
SHA256 52b84fd110c4b58d63a0f082425e161cb6439054bd24cb674c909578003c90ef
SHA512 e52a58a94593498e335bc84c51ac67e401cdc237cf5a0c969fd18bac65c8756944aa48f548636fb232fc0d28a81454eaf32365482ed337accf707ad5602d5746

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6209b6108579703ef79683e5eaee73c0
SHA1 3f54ae0e97ffca997f17d351f3d071fabf90ad25
SHA256 6a475b1d8d7a4b94cad4c327a8175b6ba78a14978fa3d3ca8ccd50665f904f03
SHA512 cf908474ebf061a3455a0a69ac4f3ea06e2a405cd421e132b7fef2046a4645ab5b08f5d00f9e0520b380612401641cdab26c06233aaa26e5d948f22d726db629

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8395fd92720a0dd446e1bb2fd3dd78b0
SHA1 8aad47a644e27f036e324db48716a1bbcbb38a5b
SHA256 ea85f8855d5e68c4800c89d1a6218dd114b4176308aeb78f5ebb9457be9a2965
SHA512 1f83023797012799f3aaf5fcc9d1e523c6be2c00514d1351c1bd82dcc385c9c9e8e25c00d4af2ed5f50302eed3fb4e921d3eb8209e142db18844650f705fd18e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b83613a23dfb64c5168202195c70d960
SHA1 6da69cabc0455ed38c1d03fc2eae3e8c6d254fe1
SHA256 6effafac00012bd85119b9bb97b5cce386ec5b339b138a4e9311e4b341d3f0b0
SHA512 d57b570dcef62e4f2641b555038a2489532ed7223b13db6213297151f7f0f13f858e717ab99063e26df89042cf2d8756d99ec5536d43dd3bd596824b2eeb1d7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99001cf02831c5858284f39bc7001a81
SHA1 38d6c0496b4a7c8a7e4829bb1e2cd31484202b44
SHA256 3e8d354afe631c36c16d71f0639dfd5697af6728e18b1a778af017f782d8bc21
SHA512 9619fb5bc38652c17ce57f471ba7cd2ad14f324a3b2f70aade3b7c52ab6d66fa3be61cf8c9c46f1f316a353b6d3c6d323ab0dde03ca297069550a3c12b115df3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 fba24388be651be7d3a59a339dce0cb6
SHA1 ef4c40c78b5b911bade7623ccb99be712f4ea0fd
SHA256 027baa1f028e70a65ab148a264e3c971c8e3dcf5159f36687b324019be802bc2
SHA512 eb3440d9f0169a173e46318775068def95dc33a7c5651a4adc4e1f6a51f9ae7ea5e710dbb1222591ec5bcc64acc94c65861bec45443b4c83f0c4f47650a7f9b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6b2985672d11c425b8e96ce3a499881
SHA1 c7961dc931c03c2772a35cf655c46623537f025a
SHA256 53eb0423dbdd1ca52b11b516a77fa80c4eb48972d16bd7d634644ff4b366a8e3
SHA512 11dbc72dd87083fa5ef1895cab2da81b4374e8a05b419e128bbe6869a8183434f89734b30e8b7ae1ec70241f987af06a6526c88c4b7e7681723f28eeb421023d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e77dded174cc3a3bbdc490ee375555d5
SHA1 1993946f11be12bd105ce60bbea3b9d6e6b54940
SHA256 ccac70edf080445814e1f79ab0886ba71507f1ab56c13c8a8b007519331fd525
SHA512 bd328eb306a6dc54ebe32d664e69bc244704a1e77d4e0b1dcb5ba249178304dcb6edfe5cb4792356db38ecf14a9c05042ebc134bf74eabcc935b1e2bde0cc135

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75819f2e78e4009481a0d5c4f00c7ef5
SHA1 9b7fce05523dcf71c7b4f767aac0f950a111c58b
SHA256 70b79bdb828be010c59b55ed57f8d356b28342fd744c041111b79994ddb08a1a
SHA512 5b4107a3d50001491a6c64b6b43105aa47af038bead3de2a18c5ea2851347958cc10c0489a2336c34c1efd19be346d65cdabf2c23e84a8c9cf325145b657a5b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f36755d17c4ef0b7f2308fcb7b5899ec
SHA1 b5823caafdf1cd5089a0a6c19fc47fe5d0b2f708
SHA256 a02818c90abd63d6c7b7e84d7c0df6efd929d3bfb34a3dcbe5ca72e4d7472c51
SHA512 0681032171361cbba59f44b4155790d52cd0d36f7998e26c10473bb220a7dd63f4a97730ae1aa4251ee20d0fa2549af092485044860507ba8f472d86e4c87a2c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2927d6e9586c2c680d185340f74baef6
SHA1 2b5ed6c64678714b22def8b3b27d1928b77dcd8f
SHA256 054af554273adbb6db1c9f0e32ef486684617898edd1e71cfee6ef5fcb9eeccf
SHA512 04f994305e11e946765437a08f035d5f760be7a48a1cffde52f3263a8df6b808b822f73f616ade94cad4323a5379fb0e1164bff138af324d49200667ba19b3bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 971a0b4298fd7c7e69f21cd57bd7ba49
SHA1 757a36fb8313ce0f8f576da41660891036a27119
SHA256 2e65714744c78b6028e7dc0011dcec1f1ed131f0f4566e008686963c803b1fff
SHA512 9a804527afb2bb8d825a437bf06de04b8cbef6172dc9887bfc3a2e3b9f2487d4f5a511b7f46e39bf68d374f07cc3ad4c27931da60061ae7ba0787fc86e3e0a6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43a493196d02a02f90b4f7414c33f0fd
SHA1 d1328140adb50e1f60c5a31af326ecfef7c65959
SHA256 1257ba14390354d0862707e033f7a5c8f17fe76592792dee8b2bc38bc6b61e79
SHA512 491c8220ee5257ffec677daa73a3b10dfb9d754877a8dfcfbadb084324966a992277ce13cccd7e1f342d9881b2b9d6b6c64bc2b9481435473a94180b1a3bced4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 db20696ad0cc65c8cbd40dd73311a8c2
SHA1 d1442e5d4983fc7d021e13037162942a9b844418
SHA256 2d2c02c270781a46f60f53962571ba999c922f92c2429753e7971b8a65a4bd6f
SHA512 8488bbdb86b79207c43e2930e3cb381cb48a51f87bbd993e3d53daf09b3e06dfc34d82bdb6d82a366ff1edd7caa901ce67cd77b85af86f7e34f866d8b657cf82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74efcc4b8b8c642fe914b64e30279e78
SHA1 0b96548cd7a064507447761ea2f80a9989505a07
SHA256 78bd6ec2b42f3f673784fae47a356d8dcda49e202e6ae9495724021a2418e9bf
SHA512 0eabfecaba2353a787622b91782bc0328a499d6c13cd6d15750aa7a476a9aaba75f9e2415a9a813f505d4336c39f4c85196e116a1a0e4927bcb81b62e62ae257

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19ee8e16ea7b8b04a885eff6bb042265
SHA1 98efa08269ae57d0b9b2189135fce245fb6f55de
SHA256 31fb09f3b08bb11049df528e3b2f804564be73788e9e67231b3920a87c5d158e
SHA512 9ca1f8a8e9a5ed3baf4b394d84ef299764a25dabe5da4d23e0bdd5a04fb7628c12669295ee048d2fcb4f876e87d1c4e826d51793a7a47bf48cae720f26d258fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b431be47ecdc96bdf000952e045af43
SHA1 44cb8435f4d45c0ff23ee645dc55a292ed38c3e8
SHA256 a45db378f1db7b5773a19ed14ebfbe76dbcecf1c5b78c4747d606a903cc07490
SHA512 b01f7592d6aac06956a49e27384a7c0c2025b088c4a9ba44eef220b41e23cc12b81bd996d8083a8ed529ac95b5352583804e8ad6ee49f0f9dafab81a653f6840

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bb5f5887a4a210cb403a336d362d7ab3
SHA1 99993b8538cd6922552da06b7efdc420081844b7
SHA256 a3e905d6ff2e22a67811051ec309014b739a025eeedafb70e2ee9492de480458
SHA512 da5046744ac10696c8026440cb5b56d9a7647239ceb2c621ffa8716ba20990b555d621b47a6fcf63f777e3ccefe4a26d53c24d2a3f8fc4cef8e3de099b5c6c4e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b15348cf51c6f1264d67c03163159794
SHA1 6b9b2d811f5524c1121002e023934a7522697b7e
SHA256 b11f710b7c513f5c4afbe62ad6db740dd87b5ea8a647b279cdbafd88fc2986f8
SHA512 2be86f4927984b366e32ed574ba01a507e6e0272b2ba6e7815ac9c3020b7f05aa71e7697c4adb0cf9e49c88ed9639cd428aa31f0654695558c3127d6eb2a1b4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ca668fc780bca5a2434d5c8b356c3e7
SHA1 6293888deab006b6def19a07188fb056d69064e8
SHA256 7597e017a3dfc3f395ec8e2e5960c84f23c4942bbb43bf98a9fa88b940984fc8
SHA512 507b453899fcd2f74a06ce93df9604aea87c321a7534029395aa27110d7d148d55f61ea9d709882900b224d9dbcfe3e6f919fda50abb8ec48be953ed138cab41

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 15:57

Reported

2024-05-25 16:00

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240640578.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\240640578.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 684 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 684 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 684 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2452 wrote to memory of 4432 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2452 wrote to memory of 4432 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2452 wrote to memory of 4432 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4084 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 684 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 684 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 684 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 684 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe
PID 684 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe
PID 544 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 544 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 544 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3412 wrote to memory of 388 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 3412 wrote to memory of 388 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 3412 wrote to memory of 388 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 3472 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3472 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

"C:\Users\Admin\AppData\Local\Temp\b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240640578.txt",MainThread

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4604,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=4904,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=1428,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --field-trial-handle=5384,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5424,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5264,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=5376,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5208,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5604,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 2.17.251.21:443 bzib.nelreports.net tcp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 2.21.17.194:443 www.microsoft.com tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
GB 13.87.96.169:443 nav-edge.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav-edge.smartscreen.microsoft.com tcp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 8.8.8.8:53 21.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 194.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 49.124.155.43.in-addr.arpa udp
US 8.8.8.8:53 170.240.154.43.in-addr.arpa udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 res.wx.qq.com udp
US 8.8.8.8:53 res.wx.qq.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
NL 43.175.22.45:443 res.wx.qq.com tcp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 45.22.175.43.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 support.weixin.qq.com udp
US 8.8.8.8:53 support.weixin.qq.com udp
HK 43.154.254.90:443 support.weixin.qq.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
HK 43.154.254.90:443 support.weixin.qq.com tcp
US 8.8.8.8:53 90.254.154.43.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/4084-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4084-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4084-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4084-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2452-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2452-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2452-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2452-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4432-22-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2452-32-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Windows\SysWOW64\240640578.txt

MD5 faf3f34e723aba381f7f4d43b7dc4f40
SHA1 b4fb808bbc51c07c6369546e78d03efbeab54410
SHA256 a92488b8b46ef72e178d693838b8dbecc1bc27d2fbe9c92c75a53618b1632fcb
SHA512 f571ecc94ffbd4dba188a72dae7aeb2e45d6e8ea6a7f597cab5b171edab3c4f8cfefd168db522291c5073e7f34908600b727bac292c5ce90b54a55d73df5023c

C:\Users\Admin\AppData\Local\Temp\HD_b6660f4b0556f0717e8d949a1df4f5be1b675403ecdb01ac48c36f6bc23077eb.exe

MD5 75f9bbc35802ae5cf0215c0ebbfa7390
SHA1 81c85fb9906c1fe95399ee19210d15d6ad4ba0f4
SHA256 2f69433df55a5e5ca40a37a40334d4fe085d1d420c50bbefc00b3eb7cd5e26f7
SHA512 4eb88bb9f2a3e1aa5d99c6e1ca6e50ab9327640388652af45a053111dd197e883541a300dbf1dce30d941eac789b4081ea066a307ddbba75e2cf2b35f4601cf5

memory/4432-42-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/4432-50-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 239aa557c50920d5b084fad8f3c40867
SHA1 5a72500c38b4c1fd633791a7b5604d2dbc7c3fd2
SHA256 223723c3c853c4f387caebaf1a5caa8428c5683fd603bc8a6af8527c2dc3c1f6
SHA512 3e2ea3d00af49e15aa83ad30236205cda1b2bb9cbe18ccddcbb8175e7b09a10e1a23f5a8be82912298ceccf95026028b56499cd7a5a82b744280653d9a183d79

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Users\Admin\AppData\Local\Temp\X.ico

MD5 e33fb6d686b1a8b171349572c5a33f67
SHA1 29f24fe536adf799b69b63c83efadc1bce457a54
SHA256 020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512 cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55

C:\Users\Admin\AppData\Local\Temp\RCX8211.tmp

MD5 52d49ac980ea0df8aa8cc7c0b4028503
SHA1 7c4307800586feee0dfa9298993bb9ed4936c209
SHA256 1f2fb95fd5dc41165ede0745665db380a47744daf53de64cf574c4be974eef30
SHA512 c740789917362d9c018e5934547f0af10fcf90bc3c8c0d70b48e13165030336c7e5f54026499bde68b851ace7d4b04bbc0f1d608965b8f097332a3687c82d862