gh0strat | d80b59c131ce6c9c9a0f8e8e64da0e40ecd1f51b3341438c8c79e77eff55023d

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d80b59c131ce6c9c9a0f8e8e64da0e40ecd1f51b3341438c8c79e77eff55023d.msi
Size 62.7MB
Sample240529-cth3msfe85
SHA256 d80b59c131ce6c9c9a0f8e8e64da0e40ecd1f51b3341438c8c79e77eff55023d
MD5 6118979ac4e9a38fb7780ca6f53e7c68
SHA1 4a17a2193cc61db115525c007f1d68c5cfb37898
SHA512 84232c44f23a618feb4244586a0481efdaec57c428ee4556dee89bbd8620e798c532a2379b9e0f510be0c58b30bffa6f03c635a38a9fdb1b07e82d67a08bcf4c
SSDEEP 1572864:KXkRVfNnFQ0C6JcFDxHrTK6RzXLD4n99rX7o5FiiK7B:Kg7ne0qD5xzQDbs5FG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3520-405-0x000000000F4C0000-0x000000000F67A000-memory.dmp	purplefox_rootkit
behavioral2/memory/3520-407-0x000000000F4C0000-0x000000000F67A000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/3520-405-0x000000000F4C0000-0x000000000F67A000-memory.dmp	family_gh0strat
behavioral2/memory/3520-407-0x000000000F4C0000-0x000000000F67A000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	YourPhone.exe
File opened (read-only)	\??\H:	YourPhone.exe
File opened (read-only)	\??\M:	YourPhone.exe
File opened (read-only)	\??\X:	YourPhone.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	YourPhone.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	YourPhone.exe
File opened (read-only)	\??\W:	YourPhone.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	YourPhone.exe
File opened (read-only)	\??\L:	YourPhone.exe
File opened (read-only)	\??\Q:	YourPhone.exe
File opened (read-only)	\??\Y:	YourPhone.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	YourPhone.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	YourPhone.exe
File opened (read-only)	\??\O:	YourPhone.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	YourPhone.exe
File opened (read-only)	\??\K:	YourPhone.exe
File opened (read-only)	\??\Z:	YourPhone.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	YourPhone.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	YourPhone.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	YourPhone.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	YourPhone.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defenderr\x.png	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\YourPhone.exe	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\zzsbas2.exe	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\1	msiexec.exe
File created	C:\Program Files\Windows Defenderr\5	msiexec.exe
File created	C:\Program Files\Windows Defenderr\x.png	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\2	msiexec.exe
File created	C:\Program Files\Windows Defenderr\librdkafka.dll	msiexec.exe
File created	C:\Program Files\Windows Defenderr\libcrypto-3.dll	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{925A5ADB-0A0A-4C2C-88D4-68947E49E186}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI780E.tmp	msiexec.exe
File created	C:\Windows\Installer\e57761e.msi	msiexec.exe
File created	C:\Windows\Installer\e57761a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57761a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
3592	zzsbas2.exe
2972	YourPhone.exe
1500	{AA97DC85-D784-472a-BB37-C1xvC0w58CF6}.exe
3520	YourPhone.exe

Loads dropped DLL 3 IoCs

pid	Process
3592	zzsbas2.exe
3592	zzsbas2.exe
3592	zzsbas2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a0e6b9f9d406b40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000081a0e6b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090081a0e6b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d81a0e6b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000081a0e6b900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	YourPhone.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	YourPhone.exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

Process Discovery

T1057

pid	Process
4360	tasklist.exe
3888	tasklist.exe
1868	tasklist.exe
1188	tasklist.exe
3700	tasklist.exe
3624	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	YourPhone.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\EditFlags = "1716949377"	{AA97DC85-D784-472a-BB37-C1xvC0w58CF6}.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
2580	PING.EXE
4076	PING.EXE
724	PING.EXE
3628	PING.EXE
1796	PING.EXE
2312	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1036	msiexec.exe
1036	msiexec.exe
3592	zzsbas2.exe
3592	zzsbas2.exe
3592	zzsbas2.exe
3592	zzsbas2.exe
3592	zzsbas2.exe
2972	YourPhone.exe
2972	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe
3520	YourPhone.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5000	msiexec.exe
Token: SeSecurityPrivilege	1036	msiexec.exe
Token: SeCreateTokenPrivilege	5000	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5000	msiexec.exe
Token: SeLockMemoryPrivilege	5000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5000	msiexec.exe
Token: SeMachineAccountPrivilege	5000	msiexec.exe
Token: SeTcbPrivilege	5000	msiexec.exe
Token: SeSecurityPrivilege	5000	msiexec.exe
Token: SeTakeOwnershipPrivilege	5000	msiexec.exe
Token: SeLoadDriverPrivilege	5000	msiexec.exe
Token: SeSystemProfilePrivilege	5000	msiexec.exe
Token: SeSystemtimePrivilege	5000	msiexec.exe
Token: SeProfSingleProcessPrivilege	5000	msiexec.exe
Token: SeIncBasePriorityPrivilege	5000	msiexec.exe
Token: SeCreatePagefilePrivilege	5000	msiexec.exe
Token: SeCreatePermanentPrivilege	5000	msiexec.exe
Token: SeBackupPrivilege	5000	msiexec.exe
Token: SeRestorePrivilege	5000	msiexec.exe
Token: SeShutdownPrivilege	5000	msiexec.exe
Token: SeDebugPrivilege	5000	msiexec.exe
Token: SeAuditPrivilege	5000	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5000	msiexec.exe
Token: SeChangeNotifyPrivilege	5000	msiexec.exe
Token: SeRemoteShutdownPrivilege	5000	msiexec.exe
Token: SeUndockPrivilege	5000	msiexec.exe
Token: SeSyncAgentPrivilege	5000	msiexec.exe
Token: SeEnableDelegationPrivilege	5000	msiexec.exe
Token: SeManageVolumePrivilege	5000	msiexec.exe
Token: SeImpersonatePrivilege	5000	msiexec.exe
Token: SeCreateGlobalPrivilege	5000	msiexec.exe
Token: SeBackupPrivilege	524	vssvc.exe
Token: SeRestorePrivilege	524	vssvc.exe
Token: SeAuditPrivilege	524	vssvc.exe
Token: SeBackupPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeBackupPrivilege	2092	srtasks.exe
Token: SeRestorePrivilege	2092	srtasks.exe
Token: SeSecurityPrivilege	2092	srtasks.exe
Token: SeTakeOwnershipPrivilege	2092	srtasks.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe
Token: SeTakeOwnershipPrivilege	1036	msiexec.exe
Token: SeRestorePrivilege	1036	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5000	msiexec.exe
5000	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2092	1036	msiexec.exe	97
PID 1036 wrote to memory of 2092	1036	msiexec.exe	97
PID 1036 wrote to memory of 2736	1036	msiexec.exe	99
PID 1036 wrote to memory of 2736	1036	msiexec.exe	99
PID 1036 wrote to memory of 2736	1036	msiexec.exe	99
PID 2736 wrote to memory of 3592	2736	MsiExec.exe	100
PID 2736 wrote to memory of 3592	2736	MsiExec.exe	100
PID 2736 wrote to memory of 3592	2736	MsiExec.exe	100
PID 2736 wrote to memory of 2972	2736	MsiExec.exe	101
PID 2736 wrote to memory of 2972	2736	MsiExec.exe	101
PID 2736 wrote to memory of 2972	2736	MsiExec.exe	101
PID 3520 wrote to memory of 3252	3520	YourPhone.exe	106
PID 3520 wrote to memory of 3252	3520	YourPhone.exe	106
PID 3520 wrote to memory of 3252	3520	YourPhone.exe	106
PID 3252 wrote to memory of 4360	3252	cmd.exe	108
PID 3252 wrote to memory of 4360	3252	cmd.exe	108
PID 3252 wrote to memory of 4360	3252	cmd.exe	108
PID 3252 wrote to memory of 4376	3252	cmd.exe	109
PID 3252 wrote to memory of 4376	3252	cmd.exe	109
PID 3252 wrote to memory of 4376	3252	cmd.exe	109
PID 3252 wrote to memory of 2580	3252	cmd.exe	110
PID 3252 wrote to memory of 2580	3252	cmd.exe	110
PID 3252 wrote to memory of 2580	3252	cmd.exe	110
PID 3252 wrote to memory of 3888	3252	cmd.exe	111
PID 3252 wrote to memory of 3888	3252	cmd.exe	111
PID 3252 wrote to memory of 3888	3252	cmd.exe	111
PID 3252 wrote to memory of 5000	3252	cmd.exe	112
PID 3252 wrote to memory of 5000	3252	cmd.exe	112
PID 3252 wrote to memory of 5000	3252	cmd.exe	112
PID 3252 wrote to memory of 4076	3252	cmd.exe	113
PID 3252 wrote to memory of 4076	3252	cmd.exe	113
PID 3252 wrote to memory of 4076	3252	cmd.exe	113
PID 3252 wrote to memory of 1868	3252	cmd.exe	114
PID 3252 wrote to memory of 1868	3252	cmd.exe	114
PID 3252 wrote to memory of 1868	3252	cmd.exe	114
PID 3252 wrote to memory of 1540	3252	cmd.exe	115
PID 3252 wrote to memory of 1540	3252	cmd.exe	115
PID 3252 wrote to memory of 1540	3252	cmd.exe	115
PID 3252 wrote to memory of 724	3252	cmd.exe	116
PID 3252 wrote to memory of 724	3252	cmd.exe	116
PID 3252 wrote to memory of 724	3252	cmd.exe	116
PID 3252 wrote to memory of 1188	3252	cmd.exe	117
PID 3252 wrote to memory of 1188	3252	cmd.exe	117
PID 3252 wrote to memory of 1188	3252	cmd.exe	117
PID 3252 wrote to memory of 2492	3252	cmd.exe	118
PID 3252 wrote to memory of 2492	3252	cmd.exe	118
PID 3252 wrote to memory of 2492	3252	cmd.exe	118
PID 3252 wrote to memory of 3628	3252	cmd.exe	119
PID 3252 wrote to memory of 3628	3252	cmd.exe	119
PID 3252 wrote to memory of 3628	3252	cmd.exe	119
PID 3252 wrote to memory of 3700	3252	cmd.exe	120
PID 3252 wrote to memory of 3700	3252	cmd.exe	120
PID 3252 wrote to memory of 3700	3252	cmd.exe	120
PID 3252 wrote to memory of 2172	3252	cmd.exe	121
PID 3252 wrote to memory of 2172	3252	cmd.exe	121
PID 3252 wrote to memory of 2172	3252	cmd.exe	121
PID 3252 wrote to memory of 1796	3252	cmd.exe	122
PID 3252 wrote to memory of 1796	3252	cmd.exe	122
PID 3252 wrote to memory of 1796	3252	cmd.exe	122
PID 3252 wrote to memory of 3624	3252	cmd.exe	123
PID 3252 wrote to memory of 3624	3252	cmd.exe	123
PID 3252 wrote to memory of 3624	3252	cmd.exe	123
PID 3252 wrote to memory of 588	3252	cmd.exe	124
PID 3252 wrote to memory of 588	3252	cmd.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d80b59c131ce6c9c9a0f8e8e64da0e40ecd1f51b3341438c8c79e77eff55023d.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4DFA576CB4F5DF4A87C0FB0101EAA143
  2⤵
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files\Windows Defenderr\zzsbas2.exe
    "C:\Program Files\Windows Defenderr\zzsbas2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3592
- - C:\Program Files\Windows Defenderr\YourPhone.exe
    "C:\Program Files\Windows Defenderr\YourPhone.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3460

C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{AA97DC85-D784-472a-BB37-C1xvC0w58CF6}.exe
"C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{AA97DC85-D784-472a-BB37-C1xvC0w58CF6}.exe" /s "C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{FF578F42-08D2-4b63-90D5-ABxv5Aw5833D}"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:1500

C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{DEDB2C53-B76F-447a-9DE4-FCxv1Dw5672E}\YourPhone.exe
"C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{DEDB2C53-B76F-447a-9DE4-FCxv1Dw5672E}\YourPhone.exe"
1⤵
- Enumerates connected drives
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{8D79BF73-64EA-4667-9B80-77xv58w544CC}.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 3520"
    3⤵
    - Enumerates processes with tasklist
    PID:4360
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "3520"
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2580
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 3520"
    3⤵
    - Enumerates processes with tasklist
    PID:3888
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "3520"
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4076
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 3520"
    3⤵
    - Enumerates processes with tasklist
    PID:1868
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "3520"
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:724
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 3520"
    3⤵
    - Enumerates processes with tasklist
    PID:1188
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "3520"
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3628
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 3520"
    3⤵
    - Enumerates processes with tasklist
    PID:3700
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "3520"
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1796
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 3520"
    3⤵
    - Enumerates processes with tasklist
    PID:3624
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "3520"
    3⤵
    PID:588
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57761d.rbs

Path C:\Config.Msi\e57761d.rbs
Size 8KB
SHA256 22dcd82fd46639bd2a0ca6659b30db3439f55f427b07cb1bafed8bf86b32a675
MD5 c67d8c719216ddaa6a2d8766df0d4a8e
SHA1 c83e4e50a6b9a637b2780d38177bace3a678f5a5
SHA512 ace7c2a37bfd8603b090337af655ca07533a22b4681e005551c372d53029f479ca609c78de0d45b3f0dc7eef38ae358bb46e232fa4605ca9c31791bd21e94d15
SSDEEP 96:Wm7pwBmHIJohvEz+qAmUzmTC6TlFUzmTCsjf+DYTlqrkp3gt5zIJ3dVxC5pKBbfJ:v7pwwoJohvEMZaOCgaOE+h55pQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\Windows Defenderr\1
Size 335KB
SHA256 1cdd083af4ded015cae6e74dea8e6273da7d104cb72541dc7972c44e1d2e05ef
MD5 282758b71645bf2cdda0a355237ebcc2
SHA1 0b3992f973b2af51b91a2fd191c90872803a3817
SHA512 22c124e89226ef8b5707203826edc3bc41d4f40fd2c6a193f69883b1c01faccb5ecdfe4a1256583dbb28a1fad56694ac90d1c1c24c824f80bc48881432851a58
SSDEEP 6144:7CsyBCbX6fjI7mUXl7PW4xzIphcdomS8rmP9:OXcbcw7P2phrP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\Windows Defenderr\2
Size 106KB
SHA256 e619d9e365fd748dd3d355e037854b77731d803a2b9e46f9b3dbc7772b18073e
MD5 ec6d6d4a4d31668df56c365cb5ed3ab0
SHA1 b308362766ad315577984b1236a96fb8363ddb32
SHA512 5dccb5a85b264f7350f77ef1d7e7663731e5ccf63ca357ec9e4529a94e08ffe528d288809f7f54dd40720f9bf6610d5c811f1cab46fec7cad9df6cb3c344d324
SSDEEP 3072:XOXSozY62R3YHvNNlwPVdsgUmBl2ctClRcd:e38/RIPblIXltwRe
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegWorkshop.ini

Path C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\RegWorkshop.ini
Size 1KB
SHA256 321f7eee9d6b206f084b2036ba8b4cedf18a01ce1946dcc4b4cbd3f1bd77c434
MD5 007761c9938b6312984c40ceff455fde
SHA1 1fbbf1ca2b627859c319543169559896059e71ca
SHA512 e8931fb9f987e6baa153fccef90493b9e5e86f275a6bb2229e7d0eb33215efc54b7378afb32238c5a2f0ca9c49128e9e8c0e24f5b8c9a64b15d9d1d6ca414125
MD5 SHA1 SHA512

Submit Download

RegWorkshop.ini

Path C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\RegWorkshop.ini
Size 2KB
SHA256 02af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
MD5 ff0c7c2667dff4f3ed588f40d047c642
SHA1 1162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA512 539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3
MD5 SHA1 SHA512

Submit Download

{AA97DC85-D784-472a-BB37-C1xvC0w58CF6}.exe

Path C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{AA97DC85-D784-472a-BB37-C1xvC0w58CF6}.exe
Size 1.0MB
SHA256 27c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
MD5 217dc98e219a340cb09915244c992a52
SHA1 a04f101ca7180955d62e4a1aaeccdcca489209da
SHA512 dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
SSDEEP 24576:bIyF/qfrA6aT976FsnYp91GNaAX4Ab6AlewmQ6BZNeZ:zF/4rq6FsnYpmNaAX4AlewmbNeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FF578F42-08D2-4b63-90D5-ABxv5Aw5833D}

Path C:\ProgramData\{67DED6DE-B7BA-4593-8DC0-3Bxv57w54A9B}\{FF578F42-08D2-4b63-90D5-ABxv5Aw5833D}
Size 242B
SHA256 a0dbf36d3e1f99c7944783b4f2ce0fc6d2f24ca924528c15e62e2468f4a7965d
MD5 e4a8a02d6e6b32a61db4cbca3c66fdc6
SHA1 74c2c968979930c474d21e2d7cbc97be5359e71e
SHA512 7571fc1147f738c7c73b6e242119fc91d56a37241cf69ba24e1f591fbdfe2a986a13387bcc9806961a703e6a6524e4dc019557688d8571154f3daa97e542cc45
MD5 SHA1 SHA512

Submit Download

{8D79BF73-64EA-4667-9B80-77xv58w544CC}.cmd

Path C:\ProgramData\{8D79BF73-64EA-4667-9B80-77xv58w544CC}.cmd
Size 445B
SHA256 f7961b9472465756805b7ec3bb89f13684c777d277c18d62485dad9a9650f86b
MD5 6a87e7bf97b06a422fbb15640fb4a1b0
SHA1 9bcad62aeefc6a018c6cf1520a48ff24ac40c7fc
SHA512 c2e25b1251e92032ab66b79cea92ce907d23d3ad35a480e64d9c6e78800bd660ed5e1038281ba44f3dedc8939ae9db74ab3cec4df56dbd775c9ab32f90684e80
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\InstallOptions.dll
Size 14KB
SHA256 aaacc7ef5cb2baf2338ac8e8479227e0a6336a6509119543680efa1dcdbae6a6
MD5 5d425526856cbdb7b14c75df417b6ef3
SHA1 46407f40cac772bca3804dc80fd489f87668a9e3
SHA512 b806bf9622040d120b407ae83d20ae935c9ff210332062f8fa3eccecba2a41bd041cf9523d500f9ce11b73076b97a884907cc06722531c2fe9b8d96ec16124fb
SSDEEP 192:74n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjHK72dwF7dBOne:sn3T5KdHCMRD/R1cOnrjH+BO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\LangDLL.dll
Size 5KB
SHA256 6ab9ee3478f20c33ee37944720e2fab4fd21580d66e60de18a5d9b559d2589b0
MD5 20231d894bf014965d1aeccf79ab8ef3
SHA1 cdce15f0c10bc8a7ac72da25ee66e876bf9ea319
SHA512 c84094ffb5072528cecce86ce43b0dc5599b344fcfabf14203dbeb8e08b4e522a69f2eb6e4bc379df98f1c2214c4322b32af25353ea320a18339bb924feaf51c
SSDEEP 48:im1TEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0JPof5dwe:F1Hpl9NLBAZuYtR0gd
MD5 SHA1 SHA512 SSDEEP

Submit Download

NsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\NsProcess.dll
Size 4KB
SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
MD5 faa7f034b38e729a983965c04cc70fc1
SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\ioSpecial.ini
Size 687B
SHA256 a5f3aa863739cc18d9810b7518b570bf1cb907e34062c7e24a7284828f8e7e9d
MD5 954d8705341d303956935227bd5a1eb5
SHA1 fe7cc24cb2a970714d79aaf3d170c391bc219670
SHA512 47612a5d3853769bdc9e28bf32c6f944914470b5d2777a39d1100f2e16781e554e862d14f125ff06faa6cdcfad7858ffa38f3cbf538b83654bd09c03e59fa17e
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.7MB
SHA256 cd0ee5aacf85003375d74e5c4e86cd5cc67c4d60963ba67bcb9ecfd8a0994630
MD5 c52913b5d671994a64df8409f4e7f78d
SHA1 b51a72f46252a22bdaaf85ddb515409559fa09ad
SHA512 2f3bf05d318c045ae3b112336759e6813160698526bf72ad33e88c81efd3e48c394a0919421e9156c2f5ece73c4af6170f5686b19740f801070d6b8db62f988d
SSDEEP 24576:5Sqm41xjdoO/vvTLEhB+2Hmhii+5zQqK1TRN56wWaWatAyNW4BluLqhEW:f
MD5 SHA1 SHA512 SSDEEP

Submit Download

{fe86c36b-3305-4e8d-811a-87e6ca9495fd}_OnDiskSnapshotProp

Path \??\Volume{b9e6a081-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fe86c36b-3305-4e8d-811a-87e6ca9495fd}_OnDiskSnapshotProp
Size 6KB
SHA256 b57e53306256c9f2f24edd26d62ef54bebdfd7f0fc2e1305808cca5f580c4a26
MD5 14fe83b4d394ab61e699e2ceca3dc714
SHA1 f2824e3ca1233e4fe5ba72b680512a5beeb77e5f
SHA512 984ac08845a1815f6d4a58fcbe25aac2b3d45f600dadcde627be946b99662994396f5aabe28cbd375aa2ea6474ff876030b6bec8dc8b23daeb3323dc60a85b0b
SSDEEP 96:F4dR4RWlZhc4xDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:6tBb++1Vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2972-399-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/2972-241-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/3520-405-0x000000000F4C0000-0x000000000F67A000-memory.dmp

Download

memory/3520-407-0x000000000F4C0000-0x000000000F67A000-memory.dmp

Download

memory/3520-408-0x0000000000400000-0x0000000000461000-memory.dmp

Download