Malware Analysis Report

2024-09-22 15:23

Sample ID 240605-bmyn3shg3w
Target 96dcd91f49a34f53db4f47e067d72753_JaffaCakes118
SHA256 ab37d673d3b4807982fa778c23f779b8117a3f270cdc4e089ae8af31f8076486
Tags
rootkit purplefox
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab37d673d3b4807982fa778c23f779b8117a3f270cdc4e089ae8af31f8076486

Threat Level: Known bad

The file 96dcd91f49a34f53db4f47e067d72753_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

rootkit purplefox

Purplefox family

Detect PurpleFox MSI

Enumerates connected drives

Loads dropped DLL

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-05 01:16

Signatures

Detect PurpleFox MSI

rootkit
Description Indicator Process Target
N/A N/A N/A N/A

Purplefox family

purplefox

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-05 01:16

Reported

2024-06-05 01:16

Platform

win10v2004-20240508-en

Max time kernel

10s

Max time network

11s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\96dcd91f49a34f53db4f47e067d72753_JaffaCakes118.msi

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6610.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e576522.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI65EF.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI65FF.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6571.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\sysupdate.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6630.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{0EB25602-EC0F-4998-BF6B-8CA9440992C1} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI669E.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e576522.msi C:\Windows\system32\msiexec.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "197" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 3816 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1880 wrote to memory of 3816 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1880 wrote to memory of 3816 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3816 wrote to memory of 2376 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 2376 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 2376 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4248 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4248 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4248 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4808 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4808 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4808 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3956 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3956 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3956 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 4528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1140 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1140 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1140 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1488 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1488 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1488 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1928 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1928 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1928 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 748 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 748 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 748 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3064 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3064 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3064 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 5072 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 5072 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 5072 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3688 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3688 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 3688 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 2252 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 2252 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 2252 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1780 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1780 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 3816 wrote to memory of 1780 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\96dcd91f49a34f53db4f47e067d72753_JaffaCakes118.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 7476D0376F5C6E1FBE44B566EDABB11C

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3955055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

C:\Windows\Installer\MSI6571.tmp

MD5 aaab8d3f7e9e8f143a17a0d15a1d1715
SHA1 8aca4e362e4cdc68c2f8f8f35f200126716f9c74
SHA256 fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889
SHA512 1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

C:\Windows\Installer\MSI6610.tmp

MD5 3eb31b9a689d506f3b1d3738d28ab640
SHA1 1681fe3bbdcbe617a034b092ea77249dd4c3e986
SHA256 3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46
SHA512 2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09

C:\Config.Msi\e576525.rbs

MD5 ca191eee453aa42de9cdb07ea562c3e7
SHA1 e0e5b66451a4efc54b227e30e69dbb722c54a791
SHA256 8e0af4077cde9b9eb2562d85396673c145d9acf9b53691ecc6930cd1eb7b3241
SHA512 2170d7b910e9a2ebe09f71deba1e10f6e5ca08d6966871fe78e110c38118984fcb5fea8598a9933298cbd3cde7d2d17ec18daa317c374b0c6cb54b2219399d0d

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-05 01:16

Reported

2024-06-05 01:16

Platform

win7-20240221-en

Max time kernel

8s

Max time network

11s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\96dcd91f49a34f53db4f47e067d72753_JaffaCakes118.msi

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI147D.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\sysupdate.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f7612a6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI12C6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI1400.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI1624.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f7612a9.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f7612a6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI1382.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f7612a9.ipi C:\Windows\system32\msiexec.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2096 wrote to memory of 2652 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2652 wrote to memory of 2588 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2588 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2588 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2588 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2812 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2812 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2812 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2812 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2436 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2436 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2436 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2436 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1796 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1796 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1796 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1796 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2984 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2984 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2984 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2984 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 3020 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 3020 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 3020 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 3020 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2508 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2508 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2508 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2508 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2528 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1228 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1228 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1228 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1228 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2084 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2084 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2084 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2084 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2192 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2192 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2192 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 2192 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe
PID 2652 wrote to memory of 1608 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\96dcd91f49a34f53db4f47e067d72753_JaffaCakes118.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 1CA0DD4D1BD6180E59DF15A571F33285

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

\Windows\Installer\MSI12C6.tmp

MD5 aaab8d3f7e9e8f143a17a0d15a1d1715
SHA1 8aca4e362e4cdc68c2f8f8f35f200126716f9c74
SHA256 fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889
SHA512 1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

\Windows\Installer\MSI1400.tmp

MD5 3eb31b9a689d506f3b1d3738d28ab640
SHA1 1681fe3bbdcbe617a034b092ea77249dd4c3e986
SHA256 3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46
SHA512 2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09

C:\Config.Msi\f7612aa.rbs

MD5 53a413584309c58f04290eb8f16d488c
SHA1 354cd84790be747c1b2eea5ee372c6ca683f6988
SHA256 f83a8f7fbe679c8e7c9b11deb13a1b2b881b92c87fbdf319cb1349f401c56b59
SHA512 1b32771568ce9d8df9c1bd106879bd66b10f34a0ad424e5fb1e437c77b287f63526e805d40db0b51af072dda7a76477648d03a02d3b15bf1e3466e205701fd5e