gh0strat | 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
Size 4.4MB
Sample240527-evmtbsgg82
SHA256 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb
MD5 fd37327f6c3016a4621c4ed4d499dbc2
SHA1 630c9b0dd6b29641e70b36a1c4a62eff874ef845
SHA512 11630832ae114099d2181be3b775ce40830a199da92113c72d3efc9d0739895aaad13fb071ed3f155444d85c4fb30d652ad5a82bb13fa22de0cbeb573a9a192a
SSDEEP 98304:Dws2ANnKXOaeOgmhy0Rmn9zd308KDG235p:FKXbeO77S2pp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2052-14-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2052-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2052-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2876-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2876-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2876-33-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2876-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/708-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/708-38-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/708-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233f4-5.dat	family_gh0strat
behavioral2/memory/2052-14-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2052-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2052-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2876-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2876-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2876-33-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2876-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/708-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/708-38-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/708-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe

Executes dropped EXE 5 IoCs

pid	Process
628	R.exe
2052	N.exe
2876	TXPlatfor.exe
708	TXPlatfor.exe
1596	HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe

Loads dropped DLL 1 IoCs

pid	Process
628	R.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2052-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2052-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2052-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2052-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2876-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2876-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2876-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2876-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2876-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/708-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/708-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/708-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240594906.txt	R.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	628	WerFault.exe	81

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D3200466-1BDF-11EF-8FD7-4E1529472204} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2812529105"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2812060407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2812529105"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b04fbdecafda01	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006dd375db7411044b87316e7a135016a600000000020000000000106600000001000020000000755037c7847d2982b09e951129729702d3606272858c0a6b4a63da91ecf4dcef000000000e8000000002000020000000dc7b3e21b12178021fff3838caebe69d270b5d8f999f60c7fb30c3475594f52c20000000a825d16f2d2a6909d4f79255d6204066e936c2364219ce13c00b530521013e4640000000b9e4039c28c27d15c6e79210f4173096b75fac67d36970aacbc7fdfac6f9211aaa1573dedada5e9d9c58d319ae43334d3eb4e1a5831c2137c112f70b92bb760f	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0dc56bdecafda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2812060407"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423548335"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006dd375db7411044b87316e7a135016a6000000000200000000001066000000010000200000005ea302557039860a35fb00c414aa42c02342968d656ab5cf96d0c69c71d56af6000000000e80000000020000200000009a0ecab5d14f220535ddfb1104e3a8b69d876cf17913c3a12689861cfc4ebbdd20000000151a9c52ab84db377e8fda4673686a98a47ff5f8110662cdcd7bab53ce61871640000000fd87d160ed6adef6716ecc4242ff967b94a36b2ef62b4f059c080c3f7fc0d2196061c9a3b08e9f812c121fbf7318da9c12a60c86fd736825e93bb66585bfb703	IEXPLORE.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1008	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
708	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2052	N.exe
Token: SeLoadDriverPrivilege	708	TXPlatfor.exe
Token: 33	708	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	708	TXPlatfor.exe
Token: 33	708	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	708	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3444	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
3444	IEXPLORE.EXE
3444	IEXPLORE.EXE
4080	IEXPLORE.EXE
4080	IEXPLORE.EXE
4080	IEXPLORE.EXE
4080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 628	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	81
PID 1896 wrote to memory of 628	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	81
PID 1896 wrote to memory of 628	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	81
PID 1896 wrote to memory of 2052	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	88
PID 1896 wrote to memory of 2052	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	88
PID 1896 wrote to memory of 2052	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	88
PID 2052 wrote to memory of 1972	2052	N.exe	90
PID 2052 wrote to memory of 1972	2052	N.exe	90
PID 2052 wrote to memory of 1972	2052	N.exe	90
PID 2876 wrote to memory of 708	2876	TXPlatfor.exe	91
PID 2876 wrote to memory of 708	2876	TXPlatfor.exe	91
PID 2876 wrote to memory of 708	2876	TXPlatfor.exe	91
PID 1896 wrote to memory of 1596	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	92
PID 1896 wrote to memory of 1596	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	92
PID 1896 wrote to memory of 1596	1896	1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	92
PID 1972 wrote to memory of 1008	1972	cmd.exe	94
PID 1972 wrote to memory of 1008	1972	cmd.exe	94
PID 1972 wrote to memory of 1008	1972	cmd.exe	94
PID 1596 wrote to memory of 2520	1596	HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	100
PID 1596 wrote to memory of 2520	1596	HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	100
PID 1596 wrote to memory of 2520	1596	HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe	100
PID 2520 wrote to memory of 3444	2520	iexplore.exe	101
PID 2520 wrote to memory of 3444	2520	iexplore.exe	101
PID 3444 wrote to memory of 4080	3444	IEXPLORE.EXE	102
PID 3444 wrote to memory of 4080	3444	IEXPLORE.EXE	102
PID 3444 wrote to memory of 4080	3444	IEXPLORE.EXE	102

C:\Users\Admin\AppData\Local\Temp\1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
"C:\Users\Admin\AppData\Local\Temp\1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 528
    3⤵
    - Program crash
    PID:1336
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1008
- C:\Users\Admin\AppData\Local\Temp\HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
  C:\Users\Admin\AppData\Local\Temp\HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3444 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 628 -ip 628
1⤵
PID:4216

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 4353c8e772765f9f44b5b51678d48e558f5c3ef3b2ff2a04d3fcfecf47540619
MD5 90e9c891fdbc30c47adf44608d1e62a3
SHA1 a41e884afa528048ccec4b6a6692e164ab684553
SHA512 e5b5d33b716d805f64030db6f9d60cab1aea1a5425f2a3830bcee402d0a42e8c2f5392df37c2662f10a96a3e375c7ae67afdfdfedcc027d40c66ffd18dd47e53
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 ebb9e1f439a715480aa69eadc7d66efeec6b3726b6653efb49f856a94a09f70f
MD5 02957f487d4bdc29ede0a2b0a55f16ba
SHA1 6f0254f56c1ce0c4f6c55c37cf0f3d05790fe1c5
SHA512 9b0ee8f4669e9d8602a66ce1ac6de48da32b9fcee54aebd1358fd207d897c6b36be7e30164371e00daadf51d9be2be57e481f94a0a3724c5af1ea5309ad51d1a
MD5 SHA1 SHA512

Submit Download

verC2C3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC2C3.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
Size 2.0MB
SHA256 c506e1eddacc729428a61f021faae0287471545fb32b5deb5e1d1e7f6f1f576a
MD5 5ffea70baa8dff06141e3145fbf160a0
SHA1 edc2213a63797297f466cdcc4a3862fc2392d649
SHA512 5477a446ea59b56e488433fe0ee433d09d0d46b902842f4dea89d42f8e1f07c3d08737b1248aa0e3dc65f4c1700006d779ba0c79f46ade911999969b84745f52
SSDEEP 24576:ikNBqTwRrbeOW/iTSFRg5zH5nA2juD2Dgdg5o08Kctfi7+imiiiiiiin2iiiiiTd:mURmniHFuDzd308Kc6lr422rTm5Ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.4MB
SHA256 b10e20c356c254af8151a48c1d2878a227f22c5ee5d851189971215bc269fe9d
MD5 b509294fb0703bc2e35e7b20f07de7fc
SHA1 74b76864f3f045ed1e2742cab5d5a0aca9bb55d5
SHA512 2636997a929f16cba52b0e5ee58a58d5784c4eaff8570cdf468398864fb17ab3960370c3ea540a07b876b2fcbe423d8877a0862c7a374788d5911798d86811ec
SSDEEP 24576:ICwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH7:ICwsbCANnKXferL7Vwe/Gg0P+WhvhED
MD5 SHA1 SHA512 SSDEEP

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
MD5 SHA1 SHA512 SSDEEP

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
MD5 SHA1 SHA512 SSDEEP

Submit Download

240594906.txt

Path C:\Windows\SysWOW64\240594906.txt
Size 899KB
SHA256 44cbaca512e3765ac72cc01bf5ab4c67eebd85ee22926cc30c069922428cbb1a
MD5 ee9d605cbc9fc6ae16898d4846fc46ea
SHA1 ee40fbb2a486c6088ecc5b6fa67fed8b148c24f1
SHA512 a5ecd38ab5f407e75521e96d24a022af527100477d022035e32bb272705455d0dbb1cfefdbd5e6e4199445b67aaed5add2118b5765d2d0fc2de068981c22ad23
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXQ:7wqd87VQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/708-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/708-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/708-38-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2052-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2052-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2052-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2052-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2876-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2876-33-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2876-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2876-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2876-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download