Malware Analysis Report

2025-01-02 15:18

Sample ID 240625-vp5d7avfmj
Target b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf
SHA256 b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf
Tags
gh0strat purplefox persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf

Threat Level: Known bad

The file b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

Gh0st RAT payload

Gh0strat

PurpleFox

Sets service image path in registry

Server Software Component: Terminal Services DLL

Drops file in Drivers directory

UPX packed file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 17:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 17:10

Reported

2024-06-25 17:13

Platform

win7-20240611-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\259415981.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425497333" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d5aa9ed7176a699d83cee4cd6fe35103947a9fa27329b25d2c278cc87c521dfc000000000e800000000200002000000051a244822fb803271221ccc2c90cdb2bed11d1e800833d32cc2dcf6807bfad5c20000000b528867abf4ec194234ce39ee5981f1f00b30d0aeb2420eb659d005a93b2262040000000a272d21aa6db7b5ffc07264367bd3b845c41ed3246eb9962b728c2d2dc1a20f0ef8676a38fa5898641913bf528708530b7920b5eff627167c7cc28e8b29a0aa5 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ced0697f7faf0f4a4af1818d30619527dd45f0d3b4db05466e5c08a2ea8fcbcb000000000e8000000002000020000000c71649a2e9407310714ea1f1a920ea762661f75c8b03d39e82dda9febe15ca37900000004072afaf321219a982164fbfce98ad9b1b3cec9ade7b761bf507c83d925f0956a9276c1a7abc3bf01e89a89e0a01eb711646fbc8d98ec074f9e8ee2d4cfdc9f3309ad00955a03b7283d26e9964c1d834db9739e7d5899d830f9db7c120b858ccd1b54a3162afa8e6b837bbdfffde58560ff22eb574b4da8b88c840d5681dc16ba134cd8871f190f575038d7b9e42e2c7400000005574c19520967bc3ce624d33df991cf75d9a89048f131268034d1b6e52a96060013eda0a723735eebdf118ee6da8b0bc8abe1c9088a58799bbd79c2cdb1568b2 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E77F2D01-3315-11EF-AB87-5E4DB530A215} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00220cfc22c7da01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2980 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2980 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2980 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2980 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2980 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2960 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2732 wrote to memory of 2628 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2980 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 2980 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 2980 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 2980 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 2808 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2660 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2660 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2660 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2660 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2472 wrote to memory of 532 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2472 wrote to memory of 532 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2472 wrote to memory of 532 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2472 wrote to memory of 532 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 532 wrote to memory of 388 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 532 wrote to memory of 388 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 532 wrote to memory of 388 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 532 wrote to memory of 388 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

"C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 se.360.cn udp
US 8.8.8.8:53 se.360.cn udp
US 104.192.108.192:80 se.360.cn tcp
US 104.192.108.192:80 se.360.cn tcp
US 8.8.8.8:53 browser.360.cn udp
CN 61.184.9.227:443 browser.360.cn tcp
CN 61.184.9.227:443 browser.360.cn tcp
CN 1.193.215.228:443 browser.360.cn tcp
CN 1.193.215.228:443 browser.360.cn tcp
CN 36.158.204.228:443 browser.360.cn tcp
CN 36.158.204.228:443 browser.360.cn tcp
CN 111.6.185.228:443 browser.360.cn tcp
CN 111.6.185.228:443 browser.360.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 111.47.131.99:443 browser.360.cn tcp
CN 111.47.131.99:443 browser.360.cn tcp

Files

\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

\Windows\SysWOW64\259415981.txt

MD5 b3e9140ae591923fcb70872c72c42363
SHA1 3bf94b547c2aa62b88acd6c171e73f2fc84a981d
SHA256 bca9b64ea3c8e176cf5eff87d9637fed82e2094aa03b604598dd96e06b30a8b0
SHA512 b796d54a09b5f9e162af68fbf2e816bb9319cb3c7eb3bd064995fcf83aa9d02b602f00906a3f6cce25f89ced04c5c197be6a86dacfaa5522784770c318a1651f

\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/2960-14-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2960-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2960-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2960-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2732-26-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2628-36-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2628-41-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2732-40-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

MD5 d3a1cebe48e6788cb68cbd65fd2053ca
SHA1 17e4a085e0beb447575c532540a7764c249d896a
SHA256 466234e741c6ef883c4549d69e81d8a131a74f33d6919be8b2743b2ba9f76b5e
SHA512 255c1fe3aa822cf8685f9589f2914121cfb480868eb668ace2180932fe29b7f8e055d52985ea4c3c9d89b2c779fc8e1d8d35f87e979b9322cb20230dc8d649bc

memory/2628-48-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7AAE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7B8B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19ee148e2ca4933536be49470bee1894
SHA1 67a69e30fb39d03d6086a29f28a5820b640e94cd
SHA256 9d277798924be674a9f9117eaf60d99c3970f03f601fe2578d3404fc0deec105
SHA512 b49491888e4ba11920336e2419a2d38ad9bd35069699b3d639f225163652e3bb1a8059d6e940978954d3ffd5064b39f744c1926390b67b449bf98d54d7831106

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4c9169d70c66d8a7071759f34fba8383
SHA1 1b7dd81c2dc728bce148d2bb0899013f73b0c147
SHA256 4c6089c5d3ab66b252595ed0186502372396a882b4f0e8a9c20db6700a4c9fe2
SHA512 c5e349d2e6f56c0a15a933fa8cb10e293127d0879a9e088827bd3a64525664588fb5ecda44f3ff3a74548ffa220e5cf7ecf1818f04cc22859c72959e7fae3bfe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5817fb6b832b23b80f652c0b8ece51d7
SHA1 f07d44926cfa5810a32ed7c4f8f99dd47038d019
SHA256 f35630d51fb17febf283ead7eaa1dcf1c7be42355af9a1c76837893d8b38f474
SHA512 84b5ec29c00ca6fd8968d10d0c17bbd4a12f05d08505fab8f33e3b7a14bf7c5d470251ecae6f32d206c0b2f6fffe41c9090c038c2115eb174885f7477acea321

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa6d866f41b767c941a554cb0363ee48
SHA1 00a9523d3734eae557ccc7e32e9c2dc067db7d8e
SHA256 bcb3c7454797a36318bd0e5cf6e0937ae1b223f3e1f2581b1f3e4ede4ea15e65
SHA512 7e431cc0c3ca5f5c520121d753b8966fd8d288a3570b288b3c030b39a99855ea310646ef97bbb8eee9f1e68e491b02660e2030244409d999a900cca98eab5d2d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bb4bb679408f47a4daf3efa7bee9494
SHA1 eddaa783f0d15b07c1f53eb6b5fcbd45c9b745a7
SHA256 14bc8c0e0a63765978b55c2973b6949a3bcede5bea3e00e253ffab3b54e8380b
SHA512 243f6e84835d358cc420488fe27e926c1a94c050f41899172ba93931dd3e5071ff2673c4ef12137bd352a38533e89188ad6bbdd05aea555ea6369dfa8697d372

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 185406c219a12af18c318e8ca396ac02
SHA1 625d488c8115c65463bdf1735118b6fa9460c68d
SHA256 650a13ce3cceeafc4608fab05173b960d303fad0cfef5a39dd1895fe029abad1
SHA512 7cfc7e598065b890a773ac2cb047c6fa46c3c3fe5a98a3fa2d8abce58b3f34b201e8d454eac3fc1db6a52fd7d1e2dfda6820b4f01182e4d835eee3e92035f373

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2ee5e31e3a9496ea820b1289aefb80d8
SHA1 22ed616a2b9f3e331d4ea67594a688bb75e5fe67
SHA256 90b682f299b47977ad3ad4d8453ebea23651e3b0d2aa6e7827c3de1b4bbd024e
SHA512 b13be2b39d9629ebb1f83fe47741ea6ae08344dc8b0ac22b05a0edcc55581968e04c1045b2654a6f1b5870e5d75abad29ddb6f1919967ab07008fbba42d6c119

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81089e6d614a2dac470019604cc29572
SHA1 3f7e9e61fac1c238c2ed7d8d2e3005b0aaac3b33
SHA256 339a81baff5d04e302f6d1f99f382f2434a62d40977b883dfe0b20cd66f62f08
SHA512 56da9c6a4901ab9c759ccef6a2557daf4deed1a3cb7db5c9fe08511093349f40ed3209efdaca7f1757a2776eae59ed456dda916a3b37ae2ef5c2af2c5a6a8b08

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53ea6b7f805b283c5f3e67684039ba1a
SHA1 812672d1db2a54f38aa6e363b67d3ca1aa08bd5c
SHA256 efbcf2f9758e838196e1a8f2bd336f6b0695c28485f549244c51c64a1003ecdc
SHA512 33f683a8bdab51ba4ad29221cf988548abb53a7055ed1749959eb9d15295cc84b8fc075faeece0fbe007ef5b49c85eb32a19dbdb6a63f87458bde41ca65b3ce8

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 af625282958fd1e529cfeb44ea4394ae
SHA1 ffa7cc32f20c15d6c8a1473e6ead98ab636bf7a3
SHA256 8bbe9d9a5bbc1bf4c4bae7eec33694b2017f64013ec6f47826e35dcc8b7c9820
SHA512 e9c838b6e40451ecca90c52ce48a7b140a343c22c3a469136d59e147a528e74a8bd5957c209cfc8943ee96d3ba301ced35f206bf127ca1fa7d8ba6e883f4f58e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf00e5bfa86e31797d6a8bf141f414b8
SHA1 a8514be0928043e3d92a8325cd4c47a4628d30c6
SHA256 4305e889ab9e8b4a578630bb0e9ec5d6adb5723cf2d2d34692872eb1febca9a1
SHA512 0bbece93de375d822b0aa701954eb48cdb16e90990d69155725a1d64c01072287a942bcd7ee18d0e4d2c428662dc345d24fc8fdfb8c791405d058f490df06327

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 490e1e7c70e8a902324cd156c5bc180e
SHA1 b48045082799041b2dcaf1f972d3a70f1163c6a0
SHA256 ea94ac429bf37f07361c4fc16baf18fd29131826c2d499fb6e947f848fdf140c
SHA512 f9d4d168a23036366fb8f17a91a4af8ec71df7d334cfcdf8c58fee660b9d54f73ccba8912ee5b59d035199942f529d89cbacd04130de5b8133706340dfbecd79

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e511ebacfffe12303244c7b29e3f81e9
SHA1 097717a664083a58143cdbee9b882884c7e91fe9
SHA256 c722196bcec42bdeb93c0bc8dfbed7c1e0588b7b200c660e367d2e6d664598a9
SHA512 9385f268058885aaade198589691afb59269e66d4db9a6879595b0b3a908a8a847f8c1ef2622db6981aea6e0151a81d5f4482d267c5c19e2f32b3f4280f211e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61db61b41e2cd2902de454d0b29c149f
SHA1 8aaa7a17efdbfb25fb66840c6145ea56019c860f
SHA256 508be8009c95d1e3909b4cd45af67161d62a2d9b415393a12450da93e743c825
SHA512 a42f9966f6c68e5de4709ff4a8d15f9b0eb7f86cb9ffaec7dafdb722aeaca8221bf62f7d1e3d6af56ce6aaa7caa198a0ea592d6e4600b55c3c4b9fef3158af4d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11e2ddb1d93618925c678931888133c8
SHA1 146e2d628100befa3bfa88bc829bc4040dd99477
SHA256 6a859354465056c0eb4ff88d556a13c26d4a080f67956a1c3b11f69b2b4b86a0
SHA512 a82f10b35e0901d75b6aed327d42b2637de43522c2e7f4b1ec2d6b2605edaa423337cf94b1422a97d7335b15f690db78ee505ece0ca8de92c213526ae8caa796

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ece5b341933b2a11ee5769fdd4657c4c
SHA1 e1b461ae1c37b72e641b850edb263ae1098e10af
SHA256 27a85694210309fa9aaadd8012a4a2c39f30659ca6bd43f10582a5ad2dd99e45
SHA512 c222fb9981c07e7a1351831878841f7f17cf6a22f68c7dfaf49fd11c8ee93388d5381456eec170d9ff37a93a0cd603569007a5296bf08f1504aa542cb916fd60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b95032b2f5edf833ce2aec3fa23f8d5c
SHA1 3093f2d24b9ade66b5b33370839bb4e71f3f1311
SHA256 b50981a599b42b628269768bb885592e16be4519bc33ac395a3797593860b478
SHA512 613552c5211f49129c6b27b6297f4e0950c3d762dcf2d53bc3ef42392040f82ece9da02a176078cf6abe60c9518b394e852a4869b11e3e451f7a4e555168068b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de815b69040f3d71553f66978904d498
SHA1 56265ffb04b779d6899340ec279592e82ffe0340
SHA256 742cb0c8c2354dec4d8d99c3d59d7ba305276d122b455f6f43120b6a7ddf94e5
SHA512 ff5936fb1fcbf2fb7d1ee0449d826f6b91233ce7ecc011a146119d41b419fca98bf4f14ee3da26dd6ace0836c75b58f225932eef75c5b9e11d0656cde5371ed9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63e32f8a48b2eca30b3946f43272ec8a
SHA1 dac4246ccd95cb133c2e4bc6ec294ae529f0f20c
SHA256 0be33b69030a556bc112357d3e39cdbee509b6fc68e5741d720107c53fe1d032
SHA512 796837534276be35f696fc7e258a6c84b5a5adc940fbea871057f50a9a53ef5c8a2988897c7849448acb2bc0f8dbe14ba69ddbf5aeaa61a4e55c4f459c8e1f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da9b3efee1b48255821ae41579c59ea4
SHA1 cb9ac9b145395a62a22bbc8c6cbf535d9d1a48c6
SHA256 372274c78b035e00be280b1950fd8ae5792efa2d307f22fbfa09971b888ae334
SHA512 9e0e13a90d504b46fe9e82e2f4d79110d9abe3503988e36abe9aadf3777dff5da0840740c20ea1bcad26dc39db193317e1460283ea148a91c25690352b3de419

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 17:10

Reported

2024-06-25 17:13

Platform

win10v2004-20240226-en

Max time kernel

156s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240655765.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\R.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Remote Data.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\240655765.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115042" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3305286195" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426100457" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8e15df8f8b8ae40a36846789c6c32a400000000020000000000106600000001000020000000f8b3a8417e85f9f94b96255abcb5eae370527e9d821224379ce0728132449c60000000000e800000000200002000000084206b89fb2c04de4bc9184cd0f48de6c7d7e8795c77e3358555bdc0c4d5240320000000c822c242eeb6da577913bc46552ff077ce94513d760f09010436d5554da1a8b6400000007b311579c2e303d842acfbbc7be3dc919964ad02d827bb3301c88a24c3aceda33c8d38b6de642cb3d39bc86aa4e8704ada32d10f589c2aba56192194b4b7190b C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3305286195" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000e64e022c7da01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115042" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bd80e022c7da01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F064A57A-3315-11EF-B9F7-CE289885E65A} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115042" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3335753716" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8e15df8f8b8ae40a36846789c6c32a40000000002000000000010660000000100002000000058cb547dbf8b889e8a6907920fb65d6268cc3281ae761dd476718e9edfc2abc3000000000e8000000002000020000000fe65d8ba5c57117f5a8f743b05898a2310d37aa65952295d6762a4b3a19533ae20000000b8c669077501ef3ecaa0fb4a8a2811bf9f85c521fc2564d8e6da94b6ff1aa6c640000000928cb827a90d64092e5f49a800477f9c887cc33177fdc20b3dfa1f5f54ac80452f62b867abc33b62ef4896f040837f45c50e55dca28cc0ef021295c5f41eef76 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1804 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1804 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1804 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1804 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1804 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1804 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1920 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 3232 wrote to memory of 4308 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 3232 wrote to memory of 4308 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 3232 wrote to memory of 4308 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1804 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 1804 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 1804 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe
PID 3356 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3356 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3356 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1184 wrote to memory of 656 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 1184 wrote to memory of 656 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 1184 wrote to memory of 656 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2112 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2112 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2112 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 3780 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2024 wrote to memory of 3780 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 3780 wrote to memory of 1924 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3780 wrote to memory of 1924 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3780 wrote to memory of 1924 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

"C:\Users\Admin\AppData\Local\Temp\b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240655765.txt",MainThread

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3780 CREDAT:17410 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 se.360.cn udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 104.192.108.22:80 se.360.cn tcp
US 104.192.108.22:80 se.360.cn tcp
US 8.8.8.8:53 browser.360.cn udp
CN 61.163.171.161:443 browser.360.cn tcp
CN 61.163.171.161:443 browser.360.cn tcp
US 8.8.8.8:53 22.108.192.104.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 3.166.122.92.in-addr.arpa udp
CN 120.226.0.228:443 browser.360.cn tcp
CN 120.226.0.228:443 browser.360.cn tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
CN 1.193.215.228:443 browser.360.cn tcp
CN 1.193.215.228:443 browser.360.cn tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 36.158.204.228:443 browser.360.cn tcp
CN 36.158.204.228:443 browser.360.cn tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 120.226.150.228:443 browser.360.cn tcp
CN 120.226.150.228:443 browser.360.cn tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 se.360.cn udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 193.98.74.40.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

C:\Windows\SysWOW64\240655765.txt

MD5 89bdbf19090383a359c1005ee860e9fd
SHA1 607ae2b93968075d10bdf2f0eb9370e71c3c24f3
SHA256 9893d13c648e12bcab977f9a14f03da803b2a5c9616e5a85452d388df1ae2afe
SHA512 e6a7e738f66d217feb70ef962ba1c3fddbff9dcf7270688cf305d6245038e20d3f49fe55a934ca0562c2507a2971f0982a389a69f60d3d97cd3cd1f7b77640a1

C:\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/1920-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1920-14-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1920-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1920-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3232-25-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3232-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3232-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4308-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4308-40-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_b82f3cfa745fc5365f683747a85044f88549bba30242cf9c9a24af043c6f91cf.exe

MD5 d3a1cebe48e6788cb68cbd65fd2053ca
SHA1 17e4a085e0beb447575c532540a7764c249d896a
SHA256 466234e741c6ef883c4549d69e81d8a131a74f33d6919be8b2743b2ba9f76b5e
SHA512 255c1fe3aa822cf8685f9589f2914121cfb480868eb668ace2180932fe29b7f8e055d52985ea4c3c9d89b2c779fc8e1d8d35f87e979b9322cb20230dc8d649bc

memory/4308-44-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 af625282958fd1e529cfeb44ea4394ae
SHA1 ffa7cc32f20c15d6c8a1473e6ead98ab636bf7a3
SHA256 8bbe9d9a5bbc1bf4c4bae7eec33694b2017f64013ec6f47826e35dcc8b7c9820
SHA512 e9c838b6e40451ecca90c52ce48a7b140a343c22c3a469136d59e147a528e74a8bd5957c209cfc8943ee96d3ba301ced35f206bf127ca1fa7d8ba6e883f4f58e

C:\Windows\SysWOW64\Remote Data.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 b9b9f42ce6d2b20bf169d05480d239d4
SHA1 32b094cc2ff79f07fcd68d585846b919bc350e4d
SHA256 4d16bb8c9a34d4de9d39bb5f0e87095617b5ad551112db17b38b6cb752fbdae4
SHA512 36b45c544439c6b1fab4c2fa58712475a65ad467e3da61086c4a953d6587d35f5c6ae7de740863295ae0d3534cbf67d0bed6843d95b6786b50431bfeebcf1010

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 a2addcf2379093caf039a1cd8e5a7e46
SHA1 8e4513e7bb59ebeb63f63871afb693271ef5efa7
SHA256 e3e9e1e9698bca22820fbae071ab7252d034ef8bc37941600f92d3e10aceddf7
SHA512 202f108b626bdb172791e067ff2e2987040494fffe3e3aa8847dd7ee38192faa2757a59b85dcac6c53189a1a59257f7a3fdb248e94e4b2922b375cf18aba3abf

C:\Users\Admin\AppData\Local\Temp\X.ico

MD5 e33fb6d686b1a8b171349572c5a33f67
SHA1 29f24fe536adf799b69b63c83efadc1bce457a54
SHA256 020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512 cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55

C:\Users\Admin\AppData\Local\Temp\RCXD493.tmp

MD5 a2923de0d10c0c61fe67dd24bd870755
SHA1 81c7e37040d8531a3bfa7518b1ab33ccc95976e3
SHA256 e1b4919a0571ca12466b82be5e6486874add06db160e069e9cc4e94b13ed5975
SHA512 9a65766b9894f9f69de1f362eb11629c887c417b8c63b36903cd80d75be34008e9726e3f2463f921524fc8d7c1a92feb83343957e4a4a5def7fe6d9febd836fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee