Malware Analysis Report

2025-01-02 15:15

Sample ID 240625-wck1fstepf
Target fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955
SHA256 fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955
Tags
gh0strat purplefox persistence rat rootkit trojan upx discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955

Threat Level: Known bad

The file fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx discovery

Gh0st RAT payload

Detect PurpleFox Rootkit

Gh0strat

PurpleFox

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Sets service image path in registry

Modifies file permissions

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 17:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 17:46

Reported

2024-06-25 17:49

Platform

win7-20240611-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259430489.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\259430489.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5D70901-331A-11EF-917B-C299D158824A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "42" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "209" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "276" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e93475dc44a8e92267da015818eed6c5f240097dd0ea60efac48e2ad71b514e1000000000e800000000200002000000073522d2b794a15695efe67bb9c2dda66f4f67ea58191deec7ffee4cc15cd75e7200000003e1018bef0cea3b7c27c51494daf4c32864a2877f39faf7f2d6afa328ce9c79140000000776aa3c39f1aa8c6c76e93fc73f28654e6809c15d4549c061c15f8815aee68d6f475263887b0f5f8ac2f4cf19bc521845c6fee8651fd034e1c8ed3a762cfc87d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "276" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000118068edf9f1bba21d84a1960a61dfe3e04647830f106dc80d94d83999b49cdc000000000e800000000200002000000034863c9cb5a0900991bcb75be69267bfff65e64ac10ed087f6d57ffba553bd4310010000a4184c558886bae09fa2f67da532fd29ff0e8006ad872d26485e365cacefef0613a655d54c9f142f37a1f6c96498e7ccd814d097a64482edd5d637015a5012e9aa019e32fe6ff8027ffafdc1a22164c59dc4db040b6a39f901a4caa8a2b014d2ade008e255b0a7fb4e45a5c810f4cb365009e51bf9ee36aca84591b15ed862e245df4998bc96feeda9eaa653ac25034d4a31308c1becafac6e071685d45590702c595cbc894f2dd21e37437b0381da73fa2dc0403b9befbe8f094bc6ebffa1ecc32d845c332a3a1a1d225c2e56018553545457fe753d41adb194177bf829b8716f7c614e2daa35aba9c8e36f8c519f05387c22d012a10490749548020461391030c0253df7e9c06a4c4bce19b52cced040000000febe241a03a417e722adc57cb4899723e9d767452f8d7a33efc80cb1aa42b91f81dc96e099adfe4c08525f1e7bc874cd4ae630192d66099cdafa7da1dba7ee89 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "22" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "276" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "122" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "209" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08e52bc27c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "229" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425499477" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2924 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2924 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2924 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2924 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2960 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 2924 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 2924 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 2924 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 2676 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2676 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2676 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2676 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1920 wrote to memory of 2548 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 1920 wrote to memory of 2548 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 1920 wrote to memory of 2548 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 1920 wrote to memory of 2548 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2732 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2732 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2732 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2732 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2332 wrote to memory of 1700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2332 wrote to memory of 1700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2332 wrote to memory of 1700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2332 wrote to memory of 1700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

"C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259430489.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://java.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 java.com udp
BE 2.17.107.105:443 java.com tcp
BE 2.17.107.105:443 java.com tcp
US 8.8.8.8:53 www.java.com udp
BE 88.221.83.210:443 www.java.com tcp
BE 88.221.83.210:443 www.java.com tcp
US 8.8.8.8:53 static.ocecdn.oraclecloud.com udp
US 23.219.233.119:443 static.ocecdn.oraclecloud.com tcp
US 23.219.233.119:443 static.ocecdn.oraclecloud.com tcp
US 8.8.8.8:53 s.go-mpulse.net udp
BE 23.55.96.141:443 s.go-mpulse.net tcp
BE 23.55.96.141:443 s.go-mpulse.net tcp
US 8.8.8.8:53 c.go-mpulse.net udp
BE 23.55.96.141:443 c.go-mpulse.net tcp
BE 23.55.96.141:443 c.go-mpulse.net tcp
BE 88.221.83.210:443 www.java.com tcp
BE 88.221.83.210:443 www.java.com tcp
US 8.8.8.8:53 www.oracle.com udp
US 8.8.8.8:53 c.oracleinfinity.io udp
BE 23.55.97.240:443 www.oracle.com tcp
BE 23.55.97.240:443 www.oracle.com tcp
BE 88.221.83.201:443 c.oracleinfinity.io tcp
BE 88.221.83.201:443 c.oracleinfinity.io tcp
US 8.8.8.8:53 dc.oracleinfinity.io udp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
DE 147.154.150.92:443 dc.oracleinfinity.io tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

\Windows\SysWOW64\259430489.txt

MD5 7d55436d2e6f631df08d66d53cd89dd8
SHA1 59d2862bb850dc443ef3d258b9c8f6020e3d7324
SHA256 a41a27926c8d90d69f8575bc9408c71131599ff06ae6987ff9ce297850b58407
SHA512 42d435f5192c14f15cff822ef3a9de6ce57a8db780c80b6012261c99197f0e825002d47743fc92b9b7c14422064786cb677d84ecab485609c3de4c941dad9f47

\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/2960-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2960-21-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2960-19-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2684-39-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

MD5 e25bdb1d8ffa5a9554a273e8701c7b06
SHA1 a29d7e6fbbfa458106837261b6901fb5691b7f0e
SHA256 e36bf800ac072fdafe7ca7143f90595bf16c7e28ed0e62d4ed48e0e2f15572e6
SHA512 735ce59c4a3336587b0dc35287c7bd3af445449b09b4ad2d21fc4ff0a9f86b0af7b151f06bd1d37a0eff1aeea179750b934e12e111414cb254ebd11626484a53

memory/2684-45-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2684-48-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\Remote Data.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SB53PJ2R\www.java[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWTP8BNA\favicon[2].ico

MD5 8e39f067cc4f41898ef342843171d58a
SHA1 ab19e81ce8ccb35b81bf2600d85c659e78e5c880
SHA256 872bad18b566b0833d6b496477daab46763cf8bdec342d34ac310c3ac045cefd
SHA512 47cd7f4ce8fcf0fc56b6ffe50450c8c5f71e3c379ecfcfd488d904d85ed90b4a8dafa335d0e9ca92e85b02b7111c9d75205d12073253eed681868e2a46c64890

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\c70czm7\imagestore.dat

MD5 2e29fb7eaa049bc1131615844b6548fa
SHA1 6405c3b7694e686c001f0d1d8844ba3f38e81903
SHA256 1f8709c63bfc9be3d10f1f51351cf8a168ba456866159309433f93b69ec0afee
SHA512 a5993e8ac601db8ef3f77f74fa9e1e1dab1ced024ae44695a71c7aed056cd06d59a66b88078bb4d78ecb01e2e91f576089f1204adf536989c69203afaf8a8113

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SB53PJ2R\www.java[1].xml

MD5 d906c5d4a05906f97ead312fad5b5c68
SHA1 6a47d72764366d4d5d4a641f73cf6fbf3653b247
SHA256 101d8cfaedaacaf26c2cfb403e853a70f663008a0343763e05a876f69ecba132
SHA512 0707b250e115a2349caacf536de2a15c486bd8c752347d53e0b6ac21bec0588b6b3f96961bc5c9478185ff1a4222e0a923f39d08e73ef11e4f1347b01273bf91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d298d03afbc70782487955c8bc5dbe0
SHA1 ae5e65dc224ceb6a8f6b232e4b12040e4f04bbbb
SHA256 94d3c2351278607034f27bdde13b0f7a99cce8c5a61e5c3eb0f358595631d1de
SHA512 b13804e460f1c169f061e7f725d842c0065b243286c7f41619664e134be389ed2858ee15454ff3d4167972534597c4f38f41ba86069be4bc89232f99f980cd6e

C:\Users\Admin\AppData\Local\Temp\TarD56C.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabD56A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 060b090f24cf2c496b3097837caf3c42
SHA1 70b830ec46e548310692cea8bc4ce40a951041b6
SHA256 d6bc519d0caa8401d90704939a43fd29cc298f3be1926e4d32d10112a97870aa
SHA512 82a20f78917d107b00913553361ef771e3b8b60fff5846d9046becc6f6d28f2234c6f833149a1f5746f9372d25411053c0cda1cf3ac7b4db47404caf577f0fdd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 817f788648bc7d5d78f247d3d56f1476
SHA1 65207eabaf3422788ba4f204b3f77f9a22514bde
SHA256 161a094c089bc5391105025976edbf611a4b90b701acc7d913ff77e9447390fc
SHA512 1c78cba3d8fe148a41fdc9426b951f3bb489dfe809bb05bf2b45f0fb22403416316ac9e21fa4efdb43b2c059a9819b213370ea5a084ff01ee1c69c8838448ba6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7fd24ead52ee92c6f05dd2d93d23e7c
SHA1 1ac9523be1535b37e0de18a195f0cdf56e1b4dcb
SHA256 b16bd9af97187811deda4f4c542e745b93eda53b356fbaaab054d087969505e6
SHA512 578e7e943910902e5865075923f7d615f366140a63e6e513a20ea9f951d630acb578d48bfde689764963c11293fcfeac7cdbbd0f0acc4923963875361d150b6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7335cebbe0457cca7b71d5c156c302eb
SHA1 6cf554e47c9699c696af9abd67c92ef2338cefcf
SHA256 e238e156d14345862188402b8aa3e1d3d7437746e385f2bde35dff3845fa7801
SHA512 0b8d87b30a9681d56b52dedd88edce7be3d69db421283d06dbdffda20a2387aa3d869752c79d97d8644ca8bfb47bf7aba141c94aab3ac2acfffc77f12e0f48f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7700e38363d42a509e2011274281533
SHA1 f5513ad647b5e75e4d770cf3c35d18528b2e37ae
SHA256 c6ed765aa15480fdcbc6b3371e8760c8af8811fa8dd13e3c09ff7d634d72258e
SHA512 daa716a70dd7b66e52767697725d87c0a8be04a0c91653c39f9fcf9c8f0aafa984fa01a0215fee97b1c47313c015914f788ff6d7df612efbcbaadfdfc5ec6515

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b4d4fc90b7c3a2be3ec8ebd425905eae
SHA1 c29ed81564f4f1e8db1509ea943a8f575bb8d1c1
SHA256 bc10af8577470c529dd5e36db2c8933ccfdad4346637d30d8a5d7a3298835ab2
SHA512 258b02d1b8e9404dfb87641078ca45f13fa521a0f8eb170f5b3113a5b8c453a771936578ce8465f3308dcc4a25552e1073cde2a6458da5e4c8e21cda7291340e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 adf9ccf965b1015539a8c9b6da9816de
SHA1 a32cec5f72dbc019c5cdbc2305617a13032f3c48
SHA256 812a0bb3b134b2fb3ede827ac4e80deffc3763bbc3061594351a8e9a2592af15
SHA512 5287ce9ec4b919892a574043fcd23154b1900400520564c12b5e5652cf889bc8208784166b83475e7e84177db6eb6ce4e8400e482ba06a694ba41fa3f7ff9a76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f8f6f88716bb6b8eefe44bd7c399314
SHA1 d9eb5355b182c3c8fc23c9c0358d33cdca32f97f
SHA256 400d313b291cd2b10fa58021a1965913a9ff79d1cdbb3b6a27ea2ec959c10f5c
SHA512 395f7e208353b03a6b5860557361678a994b5c53e342fd2592fa5e8640d1533128bc3cb0d1602c24f31837c484839f9621642f5394336949650f10eeb4a1b133

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 271086f1921780957ab55a32e915c4c2
SHA1 652fe475481e433504d7505cde8202ecac8024b3
SHA256 b4025bd78c7a2442929d55a1e7ba9ad6e81c1019ebf974eccdb9395c0605f84a
SHA512 a2924cf1dce3917090c21c6fc27b5e950ebe72ca55d2e658400f9d08683c1e2b48a26bd3338fff2eb072530595e33f4a4f5c88654de6397eae0260a62a6e2660

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de66c7a3473c6668f746edf443b79977
SHA1 f1aff70c50c46e6f3ee519f9fff749c685851e81
SHA256 12dbd976f70d9ffda8998e202d4ccdbde78ab4953eb70ce9acd81ce927db5059
SHA512 b4750ac2cd9164c1201ee9dc0386aa895eb1d4d5d1053bae8ef843e247c18b19a6c48bfbdc518454ac5d7f95248cf082a1c9b931d0e5ca848264c69fa931fe13

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d6d0d831014f2a5fc214744e2bbf470
SHA1 9eff9083abe5bc414f845b391ec273df1ff7db1e
SHA256 2842c12954ed5a15b1d5c5e6ccf551ba1d2fe0c227b77dc9398f6e28d9d2a1ff
SHA512 2962814f96ca71815152f60c1ae5912b0422691f087e978aef2c75152bfd0248074208fb7ae2f499f5c3b9104636a90387c7f650b0832604c936650ee6b17b71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 281723906d33c7b60c34d5b2332c62c6
SHA1 45f4d999400b2132acc6917eef828cd987d613ba
SHA256 2c8f5bde3f51cf3955563482ab4a4b3cda945b733b0a558cda3aec5b594c33cc
SHA512 1f06d4e60ba37c395c1af03c983588b7986a2941ffe0d0df6947227115e6659e5e323ee871553aa48769910d48bdeec4bcd0d2bf2a174061f67d3255d0aa108c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec9f1e0ff179665a964eb80dc902b580
SHA1 9b18236071518b92d2b03a4ae6c749d6e529452b
SHA256 6c6806c019673be7a4e7fdb4d862104e101bf9b1e9db8c23ceebb063b8dc2ee2
SHA512 c942c857b5060e6e38e8139e4f85039f6f5fe3d2ff790f279caf15f9fa123144d36d3a2e07395884b1f60d1902bd63398d4f7ad20f72c3492a4de5e1a0432040

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cab40e23ff8f2a83a1e62487e43cdf50
SHA1 08d8340ea9f20e9971fa6e2124dea4cd58434aac
SHA256 4a4d21c0c36d7d45023353e527d4a7dc4722e196724d973233586eb356836fc6
SHA512 2e81ddadd15e8f394da536d25505265378c02071fb8323a22ed1d882872270587cdb917040bc2d070924aa85de89cb7d0010e60b38ff30de97302a6fea72a0a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 234adf8dd3aacc21503db9ba8f0c19f9
SHA1 f6cfff123d7934b479e5c76e1e56353e287d00e2
SHA256 92c2b069c936794317fd25af8c36261f96b55819d0f49caddee723568a6fff7c
SHA512 81b102c0a71c1d9868ae97e59a073eb4811d6d33c4ba1a5e764d4f7f4cfe9dc281da1875e0b593cebb41e7487f30f6d3472cc954997f7e57c416e0469e13809c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecda2ed4da5113f6d88f1426bc91d79d
SHA1 e78ca1b8a46880e567481681ee26e2bd44f04b2e
SHA256 ff8de5d1ed05baa0294dccee5ae2a40c92c0ee75f43aeff87823ec59473e49c4
SHA512 2d0b079effe4bb04a1dfbc3b92ebb5b9ecf7e804e758ff52f80a43555755916cb56d284e556e018cf73985a5367543650e1958fb0a4852093571c3a97e98693f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f3856aee363d9342d6a86d389912df57
SHA1 262c0b460efc164c8b8e22bcd099406ee4569ef0
SHA256 76da4d648179fbfc8977fc3f393b061b90e43ae718aa208aa7fb0528d953ac59
SHA512 9f1225ceab87975357d93a467cdaeca8ff14d77fa68f1aacecaf79e84d6cb537509305b16eb07e2b688f1a1501c94550d70a45f4bdf5126ea71f707e9da3d314

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 905fa4989bbbf5195805669d3c15f0f8
SHA1 0af6a1af9cbde44318cd82c8a2802760f8c32f5d
SHA256 969d1bd210ad2e42353a6cd49de4659051da919f60f5b28b8324577aec90692d
SHA512 714c0805770c85d796898006f6328e14842a0007d0edafd0c20bd899b221e7f3811cbb49c2c48350b61e87920dfaa6abe44116ff175de306c2d93246522892de

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 3c42397a50dc30afda213abaf6a7eb67
SHA1 873de458aa97094adea039ce85f7ebce552d08c1
SHA256 88b35de5e0f023b7ca56c1eddbf17461f6055f22d1b5edaba7c72de48e508f06
SHA512 e8f12395f282713bdf31443faef1ffa93736b20452d866befd3ffe65c210ddefc55d58430825b04c98f3cbfab9a10a9f60aff6009ba5a0eb10668db45b397216

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 17:46

Reported

2024-06-25 17:49

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240603250.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\R.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Remote Data.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\240603250.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 464 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 464 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 464 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 464 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 464 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 464 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 4540 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 3792 wrote to memory of 3204 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 3792 wrote to memory of 3204 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 3792 wrote to memory of 3204 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 464 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 464 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 464 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe
PID 1412 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Program Files\Java\jdk-1.8\bin\javaw.exe
PID 1412 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe C:\Program Files\Java\jdk-1.8\bin\javaw.exe
PID 2228 wrote to memory of 3740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2228 wrote to memory of 3740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2228 wrote to memory of 3740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 636 wrote to memory of 1244 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\icacls.exe
PID 636 wrote to memory of 1244 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\icacls.exe
PID 636 wrote to memory of 3736 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 3736 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 3736 wrote to memory of 3096 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 3736 wrote to memory of 3096 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 2904 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 2904 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2904 wrote to memory of 4448 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 2904 wrote to memory of 4448 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 2240 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 2240 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2240 wrote to memory of 4616 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 2240 wrote to memory of 4616 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 804 wrote to memory of 4128 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 804 wrote to memory of 4128 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 804 wrote to memory of 4128 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 636 wrote to memory of 1028 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 1028 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 1028 wrote to memory of 4212 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 1028 wrote to memory of 4212 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 4432 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 4432 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4432 wrote to memory of 1736 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 4432 wrote to memory of 1736 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 1188 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 1188 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 1188 wrote to memory of 3384 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 1188 wrote to memory of 3384 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 1748 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 1748 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 1748 wrote to memory of 3720 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 1748 wrote to memory of 3720 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 4928 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 4928 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4928 wrote to memory of 3784 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 4928 wrote to memory of 3784 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 1716 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 1716 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 1716 wrote to memory of 3744 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 1716 wrote to memory of 3744 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe
PID 636 wrote to memory of 2200 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 636 wrote to memory of 2200 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2200 wrote to memory of 2272 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

"C:\Users\Admin\AppData\Local\Temp\fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

"C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\\"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\\"

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.8"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.8"

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_401"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_401"

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240603250.txt",MainThread

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_401" /v JavaHome

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_401" /v JavaHome

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\\"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\\"

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.8"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.8"

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.8.0_381"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.8.0_381"

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.8.0_381" /v JavaHome

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.8.0_381" /v JavaHome

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JRE\

C:\Windows\system32\reg.exe

reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JRE\

C:\Windows\SYSTEM32\cmd.exe

cmd /c reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JDK\

C:\Windows\system32\reg.exe

reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JDK\

C:\Program Files\Java\jre-1.8\bin\java.exe

"C:\Program Files\Java\jre-1.8\bin\java.exe" -version

C:\Program Files\Java\jdk-1.8\bin\java.exe

"C:\Program Files\Java\jdk-1.8\bin\java.exe" -version

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hmcl.huangyuhui.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

C:\Windows\SysWOW64\240603250.txt

MD5 7d55436d2e6f631df08d66d53cd89dd8
SHA1 59d2862bb850dc443ef3d258b9c8f6020e3d7324
SHA256 a41a27926c8d90d69f8575bc9408c71131599ff06ae6987ff9ce297850b58407
SHA512 42d435f5192c14f15cff822ef3a9de6ce57a8db780c80b6012261c99197f0e825002d47743fc92b9b7c14422064786cb677d84ecab485609c3de4c941dad9f47

C:\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/4540-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4540-19-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4540-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4540-23-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3792-26-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3792-29-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_fb748d914440fd9e7ba56e983f36b66ebe4044e945576133460669d224c9e955.exe

MD5 e25bdb1d8ffa5a9554a273e8701c7b06
SHA1 a29d7e6fbbfa458106837261b6901fb5691b7f0e
SHA256 e36bf800ac072fdafe7ca7143f90595bf16c7e28ed0e62d4ed48e0e2f15572e6
SHA512 735ce59c4a3336587b0dc35287c7bd3af445449b09b4ad2d21fc4ff0a9f86b0af7b151f06bd1d37a0eff1aeea179750b934e12e111414cb254ebd11626484a53

memory/3204-41-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3204-43-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3792-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3204-48-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

MD5 889252202b449ab0e340b4e41352cbd6
SHA1 b5b12b06e2f4c71f81cb052cf92129b52a6c469f
SHA256 bc0476de0ceee18f0a8f84854c71367fb000b292a3236959761b5a2d0318a19a
SHA512 2a1dcbd95347ecff0d3c12d2cb4cc752db2e1f337cfb619da009589c9d59a210dfe2d48341c6aa8c881b69dcee6063d5268f9aba1154a61b01986d5e5f3b6db2

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 3c42397a50dc30afda213abaf6a7eb67
SHA1 873de458aa97094adea039ce85f7ebce552d08c1
SHA256 88b35de5e0f023b7ca56c1eddbf17461f6055f22d1b5edaba7c72de48e508f06
SHA512 e8f12395f282713bdf31443faef1ffa93736b20452d866befd3ffe65c210ddefc55d58430825b04c98f3cbfab9a10a9f60aff6009ba5a0eb10668db45b397216

memory/636-70-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-99-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-111-0x0000029790210000-0x0000029790211000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hmcl.json

MD5 6115c32df8c4d9da2d27798ef193d96c
SHA1 36db5f5c42f9b23150100ed68fd48749ac64d7eb
SHA256 dcc94546b4d9a6a9480ade940380a021b386a7c2f9d8faf63bc2171fa6eabb42
SHA512 68d1133680c5510a23d5ac0308a6e4bc7d50d371c1982011438afbd1eb10fa295e618e12b7a428f4c8cc99e991d0ee0aa88b73eb3ea71d7209d33bbfcbb1c7e8

memory/636-137-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-139-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-145-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-185-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-207-0x0000029790210000-0x0000029790211000-memory.dmp

C:\Windows\SysWOW64\Remote Data.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

memory/636-238-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-248-0x0000029790210000-0x0000029790211000-memory.dmp

memory/2640-305-0x0000018AFA6B0000-0x0000018AFA6B1000-memory.dmp

memory/2696-316-0x0000024C2A100000-0x0000024C2A101000-memory.dmp

memory/636-320-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-323-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-325-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-327-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-335-0x0000029790210000-0x0000029790211000-memory.dmp

memory/636-354-0x0000029790210000-0x0000029790211000-memory.dmp