gh0strat | ee55621c6434493e46e15833ec378773af1aa7fcd603cc2c9dd8e861cafe1f76

Analysis

max time kernel
148s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Size 196KB
Sample240528-lhjdpsfc36
SHA256 ee55621c6434493e46e15833ec378773af1aa7fcd603cc2c9dd8e861cafe1f76
MD5 7c7cfac3c5fe04a702e6e4e8aec5a2a7
SHA1 a834beab50e0cd3736b6bfebdc938fd98ed92021
SHA512 d72c09e1f569b33859c9edb190169716e73e3c1a793d5ceb820c33811ff2c1d96ccd58435e4e013d3faafd7f67539856d6a02efae6b710e8ffb2123ad92ae1ca
SSDEEP 6144:JvnWRuh02r8eh+tDPY/yNomBTBljPmnb:tW4+m8eh+NxomBT3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 14 IoCs

resource	yara_rule
behavioral2/memory/1984-0-0x0000000000400000-0x0000000000432000-memory.dmp	family_gh0strat
behavioral2/files/0x000e00000002336e-3.dat	family_gh0strat
behavioral2/files/0x001000000002336e-9.dat	family_gh0strat
behavioral2/files/0x000e000000023394-15.dat	family_gh0strat
behavioral2/files/0x0010000000023394-21.dat	family_gh0strat
behavioral2/files/0x0012000000023394-27.dat	family_gh0strat
behavioral2/files/0x0014000000023394-33.dat	family_gh0strat
behavioral2/files/0x0016000000023394-39.dat	family_gh0strat
behavioral2/files/0x0003000000021661-45.dat	family_gh0strat
behavioral2/files/0x0005000000021661-51.dat	family_gh0strat
behavioral2/files/0x0007000000021661-57.dat	family_gh0strat
behavioral2/files/0x0009000000021661-63.dat	family_gh0strat
behavioral2/files/0x000b000000021661-69.dat	family_gh0strat
behavioral2/files/0x000b000000021661-70.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Loads dropped DLL 34 IoCs

pid	Process
1952	svchost.exe
3328	svchost.exe
3208	svchost.exe
3784	svchost.exe
212	svchost.exe
4440	svchost.exe
1960	svchost.exe
4840	svchost.exe
5032	svchost.exe
464	svchost.exe
3328	svchost.exe
3208	svchost.exe
404	svchost.exe
1652	svchost.exe
3712	svchost.exe
3860	svchost.exe
4812	svchost.exe
2008	svchost.exe
2044	svchost.exe
1220	svchost.exe
3356	svchost.exe
3996	svchost.exe
1836	svchost.exe
4432	svchost.exe
2680	svchost.exe
3816	svchost.exe
1660	svchost.exe
880	svchost.exe
4528	svchost.exe
688	svchost.exe
4768	svchost.exe
2420	svchost.exe
404	svchost.exe
2396	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\NetMeeting\%SESSIONNAME%\vofxh.cc3	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe

Program crash 33 IoCs

pid	pid_target	Process	procid_target
3960	1952	WerFault.exe	94
3172	3328	WerFault.exe	98
2476	3208	WerFault.exe	102
468	3784	WerFault.exe	107
2940	212	WerFault.exe	110
2984	4440	WerFault.exe	113
4812	1960	WerFault.exe	117
1660	4840	WerFault.exe	120
4884	5032	WerFault.exe	123
1664	464	WerFault.exe	127
3380	3328	WerFault.exe	130
3748	3208	WerFault.exe	133
3964	404	WerFault.exe	136
4176	1652	WerFault.exe	139
4296	3712	WerFault.exe	142
4216	3860	WerFault.exe	146
3160	4812	WerFault.exe	149
2948	2008	WerFault.exe	152
1468	2044	WerFault.exe	155
3428	1220	WerFault.exe	158
1800	3356	WerFault.exe	161
3748	3996	WerFault.exe	164
776	1836	WerFault.exe	167
4176	4432	WerFault.exe	170
4848	2680	WerFault.exe	179
2596	3816	WerFault.exe	182
8	1660	WerFault.exe	185
1468	880	WerFault.exe	188
4388	4528	WerFault.exe	191
4824	688	WerFault.exe	194
828	4768	WerFault.exe	199
776	2420	WerFault.exe	202
4176	404	WerFault.exe	205

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeBackupPrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
Token: SeRestorePrivilege	1984	7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7c7cfac3c5fe04a702e6e4e8aec5a2a7_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 592
  2⤵
  - Program crash
  PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1952 -ip 1952
1⤵
PID:2660

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 596
  2⤵
  - Program crash
  PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3328 -ip 3328
1⤵
PID:2708

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 592
  2⤵
  - Program crash
  PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3208 -ip 3208
1⤵
PID:4336

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 592
  2⤵
  - Program crash
  PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3784 -ip 3784
1⤵
PID:4108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 592
  2⤵
  - Program crash
  PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 212 -ip 212
1⤵
PID:1724

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 592
  2⤵
  - Program crash
  PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4440 -ip 4440
1⤵
PID:4988

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 592
  2⤵
  - Program crash
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1960 -ip 1960
1⤵
PID:1868

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 592
  2⤵
  - Program crash
  PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4840 -ip 4840
1⤵
PID:5064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 592
  2⤵
  - Program crash
  PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5032 -ip 5032
1⤵
PID:4624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
PID:464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 592
  2⤵
  - Program crash
  PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 464 -ip 464
1⤵
PID:4688

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 592
  2⤵
  - Program crash
  PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3328 -ip 3328
1⤵
PID:4336

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
PID:3208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 592
  2⤵
  - Program crash
  PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3208 -ip 3208
1⤵
PID:740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
PID:404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 592
  2⤵
  - Program crash
  PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 404 -ip 404
1⤵
PID:2212

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 592
  2⤵
  - Program crash
  PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1652 -ip 1652
1⤵
PID:4140

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
PID:3712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 592
  2⤵
  - Program crash
  PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3712 -ip 3712
1⤵
PID:4048

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
PID:3860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 592
  2⤵
  - Program crash
  PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3860 -ip 3860
1⤵
PID:4500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 592
  2⤵
  - Program crash
  PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4812 -ip 4812
1⤵
PID:4024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 592
  2⤵
  - Program crash
  PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2008 -ip 2008
1⤵
PID:4148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 592
  2⤵
  - Program crash
  PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2044 -ip 2044
1⤵
PID:452

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
PID:1220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 592
  2⤵
  - Program crash
  PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1220 -ip 1220
1⤵
PID:1924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 592
  2⤵
  - Program crash
  PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3356 -ip 3356
1⤵
PID:396

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 592
  2⤵
  - Program crash
  PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3996 -ip 3996
1⤵
PID:2936

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 592
  2⤵
  - Program crash
  PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1836 -ip 1836
1⤵
PID:1364

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 592
  2⤵
  - Program crash
  PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4432 -ip 4432
1⤵
PID:1068

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 592
  2⤵
  - Program crash
  PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2680 -ip 2680
1⤵
PID:4368

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
PID:3816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 592
  2⤵
  - Program crash
  PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3816 -ip 3816
1⤵
PID:4148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 596
  2⤵
  - Program crash
  PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1660 -ip 1660
1⤵
PID:2320

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 592
  2⤵
  - Program crash
  PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 880 -ip 880
1⤵
PID:4332

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
PID:4528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 592
  2⤵
  - Program crash
  PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4528 -ip 4528
1⤵
PID:2144

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
PID:688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 592
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 688 -ip 688
1⤵
PID:4676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 592
  2⤵
  - Program crash
  PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4768 -ip 4768
1⤵
PID:4844

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 592
  2⤵
  - Program crash
  PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2420 -ip 2420
1⤵
PID:1104

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
PID:404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 592
  2⤵
  - Program crash
  PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 404 -ip 404
1⤵
PID:388

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
PID:2396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

vofxh.cc3

Path C:\Program Files (x86)\NetMeeting\%SESSIONNAME%\vofxh.cc3
Size 18.9MB
SHA256 f588a4be5a84b87d51f5b76076b0606bdae1d1af16e860b38845c3838bede462
MD5 c9640853e4feecb93dae1589446f4a6d
SHA1 f03ae7429d569b8ed7eb743288e18110033907d8
SHA512 414de35c5f877ccc75c0cfc343953f82d5712ce5cbed6b6d2f40a8e3b0fe8a4b2304904af74a3a2a26c82c0a8363e0a8436b90569c3268959a65700e282f0ebb
SSDEEP 3072:72aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3:72r8eh+tDPY/yNomBTBljPmnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 21.1MB
SHA256 2d01522cce3d5bc3a604bd2cf50585e0f2bdec0d1706eb3d0afb6e0c4a12249d
MD5 4772ebdd04f9fe395e3d7b69546e2f3e
SHA1 ac070f50e13a87734a0b1167091156b2aa4299a7
SHA512 3c4ff2cd55a9c63a30d50256e34f187e320387b60ae70b0c99d703058e81818aa1b98cd2c6f44426886e8d2ca1fdaf6704c242a295fb2b81ca84c64e5b2d9a80
SSDEEP 3072:J2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3vDwKVLY/HyvyE:J2r8eh+tDPY/yNomBTBljPmnbzDPY/yz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 19.0MB
SHA256 1b59d773cb8ec82fe93b3364a8234ccabb43f7c1b4a30e33b02e4fd5b7aba36f
MD5 0c4318615fbb82af26d5e37eb88611f0
SHA1 960c89fd2eefb19d77588ad5677c14906147f308
SHA512 2b42adcb63535fd8074455325f3539b1286f961dcdf00204771473c80102724e433c05115162e3cd9834d9c1b5fc5f26318a248daf95c33507f6371b1c3bf0a0
SSDEEP 3072:n2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3nfhjjDwKVI:n2r8eh+tDPY/yNomBTBljPmnbTtDs
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 23.1MB
SHA256 ee58a56905cc1fc6560cf8672cf14e07261e18ef50fb9bee9e24310cf594d0e9
MD5 632977e8c76f82892fa4ffd7f0f0f6b8
SHA1 ab2cf026869498df190948d7dd4c3b9492b28444
SHA512 07cd8528a6df79d4c06f8b57ad7ce457546e7d182051338e077858d5c648e9fdec1074547e282eedb2e74ba7a6581d2a7105b28b1dc4eb0794b755b5958dcb38
SSDEEP 6144:T2r8eh+tDPY/yNomBTBljPmnbNNomBTBlj:Tm8eh+NxomBT34omBT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 21.0MB
SHA256 af5e7baac36cbb81dd35b7ea21b3984c45d099249c48d95c008c2c89601be09e
MD5 dd8e141b92ec7db818f045900318dea8
SHA1 51b261fe401007665cbef311a59beb6894e1d723
SHA512 721c4ff508ae2187ed94a016e86fa47f7cdd705e542f22ca95b6765837f8551055271ac0199c86b001ca106bc846bff855b7be7fe688292decae0a4dc7e27302
SSDEEP 3072:x2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3:x2r8eh+tDPY/yNomBTBljPmnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 19.8MB
SHA256 4bff741408fb094179f8d13fbbb6e298916efa18af7be29a03f85a2dc814102f
MD5 43e1b41ee2d15becc2479ce74248a368
SHA1 595159f38a8421d63534f6c29984fb3dbd7afaa1
SHA512 8d274ed6e7269846db6f56a5522b5a25f7300e1e62571a3cbcdb7aaddd3d3daf2eaf689a86671a5e4fb4180f0d3cf080965e43e7c0790f37efa61836bf275e1d
SSDEEP 3072:72aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3:72r8eh+tDPY/yNomBTBljPmnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 20.0MB
SHA256 56d03eda1f1f928ee47f378612f822f5bdf5c2634afb19be263280789d89160d
MD5 409224966451afcd47dfcac2de085d3c
SHA1 ee040464e7f8fc5c093816bca9e70cef7a310b93
SHA512 0ca835522ed6b55ceccf4f32b46ea191daa81f5d94f3a4d759b6890340424bc36d71292f1620c9439e2d50b41e36e70392fc122cc909656955aeecd0b9656fa3
SSDEEP 3072:p2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3nb:p2r8eh+tDPY/yNomBTBljPmnbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 19.1MB
SHA256 1e8c867b91f34d2ba800daa59c41aafb65907cbd64062546f892a1e477bc4e30
MD5 e7fbd7711d5d8d9a7c1f32ea2ca45b95
SHA1 9af87653e9fd2e7ca7ee6524afb6e57317198ec5
SHA512 14662fa7e5bf348f3d83b08b330baa329068f2cd29c1e58c0da0ba4e52eb7e8842514b049d38961f83479f332df1cd4379e606e2bb7d1822f96505d77b0447ac
SSDEEP 3072:A2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3UjDwKVLY/Hyvw:A2r8eh+tDPY/yNomBTBljPmnb+DPY/yI
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 24.0MB
SHA256 9d6c888671bb592c8081a1b730a6e2f6fc8c9ad091c9b9e5c7e33414510a4898
MD5 ebbe34bf90f845f7b64ca8e02ac1d9f0
SHA1 2b3f8fad06807d9c36fb55d126be8843fc59326b
SHA512 ace6ba0592f59c45c256842e58488174990cd53d2aa40a8df1738d79f7969f803bfd1269b26b8f20cad2d25b5a358051134d7754e22a6351c75e14b521c73b51
SSDEEP 3072:I2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3yeF:I2r8eh+tDPY/yNomBTBljPmnbmeF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 21.1MB
SHA256 314255c5b9422d8225f3371fa92e69ebb5d94c52bc10536279ec0af921d9c96f
MD5 29d7c33b469ed32bd7ab12ee5e2a1d51
SHA1 0e6d155088050109e5a5a97aba10a5dc0094c5c7
SHA512 f884d2fdc3288a2073e23a09f7b274dc8dd02b8dbf980430a5ef3a3d16ff4211459b728052898ad28ca7b343fc8e4bd82fd304891c510c941063c40de8f08500
SSDEEP 6144:02r8eh+tDPY/yNomBTBljPmnbpNomBTBlj:0m8eh+NxomBT3yomBT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 24.1MB
SHA256 80b3547416b52a44073835a89ac283c0ec9e199a0d503104745282262b802318
MD5 85f80fdf5e6f786b15582697671c749b
SHA1 c0552b7fd6ad2afb8cdb68f3a606fa3a071281d0
SHA512 4d067d0f6de02d46c96d5f521a2ed9863d7d20237cc1c13daaa847d3b20dc6391da3e7ed3d4ba99a5e869e534117d307d6745ca34591ee92332db0e72e0b840c
SSDEEP 3072:F2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3mLY/Hyvy3oo:F2r8eh+tDPY/yNomBTBljPmnbEY/yNo
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 20.0MB
SHA256 7046838ccc412db563c802c41de4f62089c6eb958aff27dfca63b4d76050c162
MD5 1785e95b9f35d5316360d62a8eb4425e
SHA1 5ccbeca6bfe6327bf80e09a7e4e557c656910401
SHA512 7edbb7dbb242fd1b779bd15b8ddfa7b48b9a7419606b4859540b454c67d886890e81ab293ae8f3dec4003a2697acc3d516d0324584051f05b204af798980ea40
SSDEEP 3072:T2aA8eh+fhjjDwKVLY/Hyvy3oomBTBftjLTYXnbr3Rh+fhC:T2r8eh+tDPY/yNomBTBljPmnbth+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

vofxh.cc3

Path \??\c:\program files (x86)\netmeeting\%sessionname%\vofxh.cc3
Size 24.1MB
SHA256 b441551047aa2faeefecb289bfd29cc2e19140dc7770f1fa511379452b2c99e2
MD5 8c79e7ac15925c5befaff592193b0407
SHA1 58b95b1c0d81a44b9cf10b71d85a72f35c4ab52b
SHA512 d830e55ad7d6fa09773a74620ca49daa1e3c1307d7221a8aabd8883a1441277350e4f0a5466a5fb57b1951f8d35ac934395f9e671e7e5dda01672a5f1c8d6322
SSDEEP 6144:n2r8eh+tDPY/yNomBTBljPmnbfomBTBljPmnc:nm8eh+NxomBT3QomBT3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1984-0-0x0000000000400000-0x0000000000432000-memory.dmp

Download