Malware Analysis Report

2025-01-22 14:30

Sample ID 240623-r8gkpaydrp
Target 06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118
SHA256 b45e99d364b9d9c70ba5b2d4fdd9b014a34368b7a8ef1bb5887927b25461ddd0
Tags
gh0strat rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b45e99d364b9d9c70ba5b2d4fdd9b014a34368b7a8ef1bb5887927b25461ddd0

Threat Level: Known bad

The file 06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

gh0strat rat

Gh0strat

Gh0st RAT payload

Deletes itself

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-23 14:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 14:51

Reported

2024-06-23 14:54

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\inl6033.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\4CF7.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl6033.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\e57613a.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{5518FC90-76A3-47FE-9440-7FF44A419D13} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6292.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File created C:\Windows\Installer\e57613e.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e57613a.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\4CF7.tmp

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4888 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\4CF7.tmp
PID 4888 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\4CF7.tmp
PID 4888 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\4CF7.tmp
PID 4888 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3868 wrote to memory of 5064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 3868 wrote to memory of 5064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 3868 wrote to memory of 5064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 632 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl6033.tmp
PID 632 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl6033.tmp
PID 632 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl6033.tmp
PID 1788 wrote to memory of 5096 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1788 wrote to memory of 5096 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1788 wrote to memory of 5096 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2208 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\inl6033.tmp C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\inl6033.tmp C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\inl6033.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\4CF7.tmp

C:\Users\Admin\AppData\Roaming\4CF7.tmp

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3388 -ip 3388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 264

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS5C6~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\06A070~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Users\Admin\AppData\Local\Temp\inl6033.tmp

C:\Users\Admin\AppData\Local\Temp\inl6033.tmp cdf1912.tmp

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 389BD99C6FDE3D34362CC177CDC2B5EE

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl6033.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump3.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
US 8.8.8.8:53 www.xunlei100.com udp

Files

memory/4888-1-0x00000000001A0000-0x00000000001A3000-memory.dmp

memory/4888-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3388-10-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/3388-9-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3388-12-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS5C6~1.INI

MD5 aec231b6492c583e2b574d5d8df0ac4a
SHA1 cdb85171641b532ffd1755947c48b9dc4b5215a4
SHA256 50c9ca92a66571eab06ec5c4300be1dbba5de8a7cce68fd33da1fbb8f2eafaef
SHA512 0d50b400956981f4f7584b5918302e8d9da5eeb74d1a6225722ebbeb939a95505cc456e81312801fbc3fc8badbbd9e2afa7c27c167e882824f40334672f036e2

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 d20d9eda31a2d0300e4589df7f352370
SHA1 79b46d2dbb489914cfedafdbc90e62951471b48e
SHA256 d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512 d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

memory/4888-31-0x00000000001A0000-0x00000000001A3000-memory.dmp

memory/4888-30-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 e01a96b756938e3da458b3400f24d8f8
SHA1 cef57e2f7b8d5d51167ca535597716f5bed8fe45
SHA256 7d5cc1f435684cc8d9d486b5e48b75ca5cda92c1f6e42b7b3145ae12a73a0502
SHA512 438d4bf8376cefd5ea66dbca5820324b25603c75b846cc0db050dcbcf00dee02f7da719ee7f44f18075a17985e17e8a43eaabb883387df0b639518b3aa547a97

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\e57613d.rbs

MD5 a4e14d5c4514e0a690bcb4e693a00446
SHA1 c9557606a60073c2f7ea15098ac37ab81c239a2a
SHA256 30cdb7a1c709c5d9b2b8559ecee4d6781a9d8d6532f88765b264cc5bee91ad0e
SHA512 1d4fb1ce69fc0f852da0db4310683c106040050a946d556ea869f3058ad8cb51d6dc223d7439a6c067319d31204b1feb89e3049b02cbe62ced5d0a079e83ca83

memory/2208-76-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 14:51

Reported

2024-06-23 14:54

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\311E.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl5247.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\loader.dll C:\Users\Admin\AppData\Roaming\311E.tmp N/A
File created C:\Program Files\Common Files\lanmao.dll C:\Users\Admin\AppData\Roaming\311E.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\f76532f.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f765332.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5503.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f765334.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f765332.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\WINDOWS\vbcfg.ini C:\Users\Admin\AppData\Roaming\311E.tmp N/A
File opened for modification C:\Windows\Installer\f76532f.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\311E.tmp
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1984 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1984 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1984 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1984 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2368 wrote to memory of 1532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2332 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5247.tmp
PID 2332 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5247.tmp
PID 2332 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5247.tmp
PID 2332 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5247.tmp
PID 1880 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\inl5247.tmp C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\inl5247.tmp C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\inl5247.tmp C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\inl5247.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\06a07034b4f0e9637747d0a42effb0a6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\311E.tmp

C:\Users\Admin\AppData\Roaming\311E.tmp

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS4F4~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\06A070~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding DBC9D9A50E03DB0E91DC96F427318192

C:\Users\Admin\AppData\Local\Temp\inl5247.tmp

C:\Users\Admin\AppData\Local\Temp\inl5247.tmp cdf1912.tmp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl5247.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump3.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
SG 170.33.13.246:80 bofangqi.6gg.cn tcp
US 8.8.8.8:53 www.xunlei100.com udp
US 8.8.8.8:53 download.lava.cn udp

Files

memory/2008-2-0x0000000000020000-0x0000000000023000-memory.dmp

memory/2008-1-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2008-8-0x0000000000370000-0x00000000003A0000-memory.dmp

memory/2924-12-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2924-13-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2924-17-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2008-19-0x0000000000690000-0x00000000006A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS4F4~1.INI

MD5 b858192e83229abbb2c3ddc4968975b0
SHA1 7e97481123de7a74c38ff404c2138a27bec7da6b
SHA256 d03c84a180780b3ef1855bc4016b89494178ce5c7a93690b5c878f421a830c16
SHA512 3e53c4b59e9938d226f1a64c0375c768a3f20a6109fb2cb954b741ffb75188a9e487676eabfe80b1f3c24f81a4ef917347503ee536e03213a1b567d2947daee5

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 742d0751501b1f11128f18300ec3459b
SHA1 a8e907626a6ad64d15fe2cf2ba2a5a4621f3852b
SHA256 98a13aa910a8610cc7b11e689f5bf94bdc788266dcf8eb9e9d23d39cad4a0342
SHA512 b77249baa1d89d7a438d9a16160c6c512e5f73828e6136e2ad9b383e3672a5c4250608e4c42ecc11685ae74168cc16c7eb0e23266ea80cd0f898833d83b3adb6

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 d20d9eda31a2d0300e4589df7f352370
SHA1 79b46d2dbb489914cfedafdbc90e62951471b48e
SHA256 d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512 d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

memory/2008-45-0x0000000000400000-0x000000000043E000-memory.dmp

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\f765333.rbs

MD5 0339e9393379adc0ff2e1ff6fd97d445
SHA1 7c8fe1ecb3ff03e9811ac6f9a93866e1a335b749
SHA256 99800d8a824e5a80f4aea449fb07cd451ddc130bac7149567407e94c5e479b27
SHA512 2b60f3932c0095e8c268640202f73c0a17bf9216eea44b476f500fb0ef94450f412898ff3a469fa32e1d012e1242ddfff8dbc9eae204221e9f86281215f6dcef

memory/1880-92-0x0000000000400000-0x0000000000408000-memory.dmp