Malware Analysis Report

2025-01-22 14:26

Sample ID 240623-dy98csybkc
Target 050fa51f58b05769b17b5a848c41ac70_JaffaCakes118
SHA256 c8c752f1fb170e8a208826fedfa0069f741b8e4f0e618aec6841dae47c743d70
Tags
gh0strat rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c8c752f1fb170e8a208826fedfa0069f741b8e4f0e618aec6841dae47c743d70

Threat Level: Known bad

The file 050fa51f58b05769b17b5a848c41ac70_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

gh0strat rat

Gh0strat

Gh0st RAT payload

Executes dropped EXE

Loads dropped DLL

Deletes itself

Checks computer location settings

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-23 03:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 03:26

Reported

2024-06-23 03:28

Platform

win7-20240508-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\1D60.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\loader.dll C:\Users\Admin\AppData\Roaming\1D60.tmp N/A
File created C:\Program Files\Common Files\lanmao.dll C:\Users\Admin\AppData\Roaming\1D60.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI3F61.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Installer\f763d90.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\WINDOWS\vbcfg.ini C:\Users\Admin\AppData\Roaming\1D60.tmp N/A
File created C:\Windows\Installer\f763d8d.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f763d8d.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f763d90.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f763d92.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\1D60.tmp
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2928 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 3060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2588 wrote to memory of 3060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2588 wrote to memory of 3060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2588 wrote to memory of 3060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2628 wrote to memory of 2864 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp
PID 1744 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp C:\Windows\SysWOW64\cmd.exe
PID 1744 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp C:\Windows\SysWOW64\cmd.exe
PID 1744 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp C:\Windows\SysWOW64\cmd.exe
PID 1744 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\1D60.tmp

C:\Users\Admin\AppData\Roaming\1D60.tmp

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS392~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\050FA5~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 57D0005E155CD9328ED09F7D337129F1

C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp

C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp cdf1912.tmp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl3CC4.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump2.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
US 8.8.8.8:53 www.xunlei100.com udp
US 8.8.8.8:53 download.lava.cn udp
US 8.8.8.8:53 www.xunlei100.com udp

Files

memory/2928-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2928-1-0x0000000000020000-0x0000000000023000-memory.dmp

memory/2928-8-0x0000000000370000-0x00000000003A0000-memory.dmp

memory/2192-12-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2192-13-0x0000000000270000-0x0000000000272000-memory.dmp

memory/2192-17-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2928-19-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS392~1.INI

MD5 97e1670962e35f8df2055ed334abcbfd
SHA1 7e0ae0274df06b9fb4def1736477a70acca02f65
SHA256 26416ecba9ebb5509ead8a19e903d384b05ad6afbdb8e0859e640a7a9c92b33f
SHA512 ac918c76e423af97c8ded7dfcebb8ed10742139ed7e208266fc37d6f0a49f91d274c830a3771101e3d822dc1b5919b645d73dd85d1fa3c9dbd795aafb41b0279

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 2b7e2ff033d2ac12c56e3b6d7d207c3c
SHA1 0549ea7c9f73cef206a58eea8c4273a2f74367da
SHA256 4ba91a94b66e90e77adeafc767f29f3b6431656cc85dc436c651cfe6c559395c
SHA512 7a9f0b61dcdf218ef591d572567d3299e2c428194bb59a0eceebea0f331e7a8526c93ca4949a485bfa0fe6676f935403e61075ab9072f3704323c4023c631a32

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 a4a4219ce5fdbaf2864b04ca4e453ac9
SHA1 98bf1383e8b2f4db0388ee139ae7fe06ff7a67a9
SHA256 7ce64a6d79d1772713cf59d6575aec39f9fa00690d4c84cd2f160081b0d412c6
SHA512 22f5668719a58a4c1692ceb8aae48af9d5a53527d96431410587fa1f3f67ec9b5f0660c87fa9d931343e1be9b0f56f03c3fcd431cc2d67b104450b2ef792baa8

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

memory/2928-45-0x0000000000400000-0x000000000043E000-memory.dmp

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\f763d91.rbs

MD5 ea0da9dddaacee352afff402d5560181
SHA1 da0965021f84df7719adf3e3f06e95db31080390
SHA256 4a3aab5dc45fb8955f9d1bb77be90f4e1343bce353e494b97c397769010e403b
SHA512 fbb2b5b105a38c8bc126d974307f9b16a132b27c237a3fff52bcbced00ff51b6d595fb930a66818d7cdd1fb6fb85b4b9c5c614adbd033e01aa6e293916071c25

memory/1744-91-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 03:26

Reported

2024-06-23 03:28

Platform

win10v2004-20240508-en

Max time kernel

39s

Max time network

49s

Command Line

"C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\4A96.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\e575f18.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e575f1c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Installer\e575f18.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{DEA3B910-758C-42E2-A3A1-3CB6C5D241DB} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6050.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\4A96.tmp

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4048 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\4A96.tmp
PID 4048 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\4A96.tmp
PID 4048 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\4A96.tmp
PID 4048 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 4048 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 4048 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 4048 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4048 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3328 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 3328 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 3328 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 652 wrote to memory of 4724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 652 wrote to memory of 4724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 652 wrote to memory of 4724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 656 wrote to memory of 4624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp
PID 656 wrote to memory of 4624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp
PID 656 wrote to memory of 4624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp
PID 4624 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp C:\Windows\SysWOW64\cmd.exe
PID 4624 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp C:\Windows\SysWOW64\cmd.exe
PID 4624 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\050fa51f58b05769b17b5a848c41ac70_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\4A96.tmp

C:\Users\Admin\AppData\Roaming\4A96.tmp

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4456 -ip 4456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 264

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS5A5~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\050FA5~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding AED468B0DF2AFE8486BE5F0A821B4E1F

C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp

C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp cdf1912.tmp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl5E4E.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump2.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
US 8.8.8.8:53 www.xunlei100.com udp

Files

memory/4048-2-0x00000000001A0000-0x00000000001A3000-memory.dmp

memory/4048-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4456-10-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/4456-9-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4456-12-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS5A5~1.INI

MD5 4df192349cacce71a14382d41a001325
SHA1 fb226e940755d9a483261bea62075b30b63b3cf6
SHA256 8e822194e841ef7f8998d55bbe1fe3c3d82e6dec4420b2b2d249ca838ca91320
SHA512 d78b66339bcd667dffac08ce0eca0b191ac76cc8b3dac8c627241cd614f373f2e16b24a980a7c3e0ca4755507cb20676a7a4038d68aae5895d46e8ec07fc5840

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 a4a4219ce5fdbaf2864b04ca4e453ac9
SHA1 98bf1383e8b2f4db0388ee139ae7fe06ff7a67a9
SHA256 7ce64a6d79d1772713cf59d6575aec39f9fa00690d4c84cd2f160081b0d412c6
SHA512 22f5668719a58a4c1692ceb8aae48af9d5a53527d96431410587fa1f3f67ec9b5f0660c87fa9d931343e1be9b0f56f03c3fcd431cc2d67b104450b2ef792baa8

memory/4048-30-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 ff53c9542ea0b4ab5069074b14595fe3
SHA1 5e5f07ef580dd4060dd4b1a8a681f2c0e3e4699c
SHA256 6d0cb769db1fd4cebce02496629b72335e3ce519bbdf435f52b30b065331196d
SHA512 bc0ee7d6cebaffb6cb65e7ea263ff9b6d617fe153432981f1123090a57e92520f9945f4540bbd81d8ebc8e9694cc2c056f2720d1e3779a46e59850bd3cd1bf5f

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\e575f1b.rbs

MD5 49711c987e22f0e8261c91b787d4b9f3
SHA1 dc59432d103b4a3d29da080061e7f51e19d59393
SHA256 fcf0c569886e6b895d2dc403beedb2cc38766cda3d7c5c4f367177e42404c000
SHA512 09ecc956b98f7f467f3cb415dd2f677c936ace086f4b069070d05f24845fdfc22d27e3b78b7c4fb29ac75f407f4c8c9c100c1a1c4cdb22b138730b47c8886518

memory/4624-75-0x0000000000400000-0x0000000000408000-memory.dmp