Malware Analysis Report

2025-01-22 14:31

Sample ID 240623-r8jeaavejg
Target 06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118
SHA256 706f00830d450dcd6cd55c234ff4608bc3932b9d92c6a37bc8b0a06c650b47bb
Tags
gh0strat rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

706f00830d450dcd6cd55c234ff4608bc3932b9d92c6a37bc8b0a06c650b47bb

Threat Level: Known bad

The file 06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

gh0strat rat

Gh0strat

Gh0st RAT payload

Executes dropped EXE

Checks computer location settings

Deletes itself

Loads dropped DLL

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-23 14:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 14:51

Reported

2024-06-23 14:54

Platform

win7-20240220-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\11BC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl3297.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\lanmao.dll C:\Users\Admin\AppData\Roaming\11BC.tmp N/A
File created C:\Program Files\Common Files\loader.dll C:\Users\Admin\AppData\Roaming\11BC.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI3562.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f763384.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f763382.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76337f.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f763382.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File created C:\WINDOWS\vbcfg.ini C:\Users\Admin\AppData\Roaming\11BC.tmp N/A
File opened for modification C:\Windows\Installer\f76337f.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\11BC.tmp
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2192 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2396 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2396 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2396 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2776 wrote to memory of 1420 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2412 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3297.tmp
PID 2412 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3297.tmp
PID 2412 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3297.tmp
PID 2412 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl3297.tmp
PID 1244 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inl3297.tmp C:\Windows\SysWOW64\cmd.exe
PID 1244 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inl3297.tmp C:\Windows\SysWOW64\cmd.exe
PID 1244 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inl3297.tmp C:\Windows\SysWOW64\cmd.exe
PID 1244 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inl3297.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\11BC.tmp

C:\Users\Admin\AppData\Roaming\11BC.tmp

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS2F3~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\06A089~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 33A08589A3A432A5170059865ECED934

C:\Users\Admin\AppData\Local\Temp\inl3297.tmp

C:\Users\Admin\AppData\Local\Temp\inl3297.tmp cdf1912.tmp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl3297.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump2.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
SG 170.33.13.246:80 bofangqi.6gg.cn tcp
US 8.8.8.8:53 www.xunlei100.com udp
US 8.8.8.8:53 download.lava.cn udp

Files

memory/2192-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2192-1-0x0000000000020000-0x0000000000023000-memory.dmp

memory/1996-12-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2192-10-0x0000000000370000-0x00000000003A0000-memory.dmp

memory/1996-13-0x0000000000260000-0x0000000000262000-memory.dmp

memory/1996-17-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2192-19-0x0000000000770000-0x0000000000780000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS2F3~1.INI

MD5 f140310961c48c6e4ca4ce45357e781e
SHA1 b9647bb86b3c9d0099b8902c2eca1741c08744df
SHA256 21a3100dfffc8cccc910a086d1e27a3e7db6953db2247cc7a799a9eaacd1ec45
SHA512 06062ffac7dc50f1d9df77a3be6962ae633d9d95a7a2a1ede8ee06b63d6b9b339186b9782586d738a04ae9b97279152eea0a86bcd0f59fdb55fe474bc5f9e9d5

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 86ec9738ef74507d2ce7d52a88889682
SHA1 c5114bf1e790e58af081124b78c6bf879e46e086
SHA256 7f816909a50897bdedb9b7f8afb913e9125fc63ba27fb3b1f4dd3b725b22dcd2
SHA512 c7a95c8eaa0f7bfbab6d62b5fe2f791c0ba05a83bff9bc6c79313cd271024e9bf9094e97c443f30fe1cddab5586284f59d08b1763e8b19180b08ae677b38be7b

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 a4a4219ce5fdbaf2864b04ca4e453ac9
SHA1 98bf1383e8b2f4db0388ee139ae7fe06ff7a67a9
SHA256 7ce64a6d79d1772713cf59d6575aec39f9fa00690d4c84cd2f160081b0d412c6
SHA512 22f5668719a58a4c1692ceb8aae48af9d5a53527d96431410587fa1f3f67ec9b5f0660c87fa9d931343e1be9b0f56f03c3fcd431cc2d67b104450b2ef792baa8

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

memory/2192-46-0x0000000000020000-0x0000000000023000-memory.dmp

memory/2192-45-0x0000000000400000-0x000000000043E000-memory.dmp

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\f763383.rbs

MD5 22b4f0418be2d9b612befc5ae3f9c7bc
SHA1 e82d354173cfd2ec0e031ef415e3bdbd0a82f3ca
SHA256 5227fc7e54ef83ee39b9b2ecd6bb0baf58ee95c48dbc6b1c2927f2b4f6ac4c4c
SHA512 0e9bf6c604002e2aba8bc1b82b65936c1a2083d32d7b370a5bf37f85891a4bebbee51e92a33c167056719072036f59f96482858f8da3e58bb34d7c918687672c

memory/1244-92-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 14:51

Reported

2024-06-23 14:54

Platform

win10v2004-20240508-en

Max time kernel

44s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\inl4930.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\3597.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl4930.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File created C:\Windows\Installer\e574a09.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e574a09.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e574a0d.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{DEA3B910-758C-42E2-A3A1-3CB6C5D241DB} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4B51.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\3597.tmp

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2652 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\3597.tmp
PID 2652 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\3597.tmp
PID 2652 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\3597.tmp
PID 2652 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2652 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2652 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2652 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4568 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 4568 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 4568 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 3168 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl4930.tmp
PID 3168 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl4930.tmp
PID 3168 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl4930.tmp
PID 1136 wrote to memory of 4108 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1136 wrote to memory of 4108 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1136 wrote to memory of 4108 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 112 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\inl4930.tmp C:\Windows\SysWOW64\cmd.exe
PID 112 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\inl4930.tmp C:\Windows\SysWOW64\cmd.exe
PID 112 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\inl4930.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\06a089742b1e0a7a4745cf88bab5ff33_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\3597.tmp

C:\Users\Admin\AppData\Roaming\3597.tmp

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3540 -ip 3540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 228

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS455~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\06A089~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Users\Admin\AppData\Local\Temp\inl4930.tmp

C:\Users\Admin\AppData\Local\Temp\inl4930.tmp cdf1912.tmp

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 4C218C6BF9E5EED6BFCE3E7A32B39D36

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl4930.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 jump2.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
US 8.8.8.8:53 www.xunlei100.com udp

Files

memory/2652-1-0x00000000000D0000-0x00000000000D3000-memory.dmp

memory/2652-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3540-10-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/3540-9-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3540-12-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS455~1.INI

MD5 6dd381e687c8779806e6c18e39f8895f
SHA1 d5f81db37bcfe565e842135eb41b70a4d0e55ea0
SHA256 f6c9ba87b8a80c9de2fe14397c0901fea160dbc73efadf7605d000c477912744
SHA512 2a40bd15ea328c3ffec5a65757e3492bf69731927d8c22f984fbbbfe5b2765932b0bc3bb8876c9bde5673e20689b71cd1b238896f6fffe065cb0ba355a8c3998

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 a4a4219ce5fdbaf2864b04ca4e453ac9
SHA1 98bf1383e8b2f4db0388ee139ae7fe06ff7a67a9
SHA256 7ce64a6d79d1772713cf59d6575aec39f9fa00690d4c84cd2f160081b0d412c6
SHA512 22f5668719a58a4c1692ceb8aae48af9d5a53527d96431410587fa1f3f67ec9b5f0660c87fa9d931343e1be9b0f56f03c3fcd431cc2d67b104450b2ef792baa8

memory/2652-31-0x00000000000D0000-0x00000000000D3000-memory.dmp

memory/2652-30-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 91a841a7ed0c9240d9b65017cc181cff
SHA1 399b3211ca8190388e78e62bce086f0ea092cf7a
SHA256 4efbbf29148a31d4148f4fc9a8d51c5eeefab29919cf210db0eb6b43447d1e40
SHA512 4a835f6edbd986c06c781bf4251c8849dd5acdac582df12225078532bacda319ce390bb27cd004c17b69527bc4c34433d6fc427a9ba7907b66b0b7c453b0c5f5

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\e574a0c.rbs

MD5 f08e74e3b723a100fd96c9740151c9f8
SHA1 5eb231fc77d40e68b1b7ba28afb17fe894eafa0d
SHA256 936af2b7a536062fceed96ab392124dff5132b747abb6decece0a712ab1cfa96
SHA512 636f2f2391fa3cfc0814d23423c08fa7526902e914c293c5e223fa51b7760d38dbbcf09a3d69b42a06f8447ea71651a46aa4dfb839ae90c8c5a2a59aeb30ee9b

memory/112-76-0x0000000000400000-0x0000000000408000-memory.dmp