fatalrat | 4bf33d5531fe319bed3d1550608ded652ef6b52437b6cc94d47a0d388f5bb03b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPS办公软件 v76.23.66.msi
Size

9.5MB
MD5

8b1b9af08bc62e4608d21b5568c0a581
SHA1

acc808accbb6897da328a1def679b42e198bf9e0
SHA256

4bf33d5531fe319bed3d1550608ded652ef6b52437b6cc94d47a0d388f5bb03b
SHA512

9c03511ccc5c4f1ee386a61e91f9afadc7310d1798a2ba7d233a308fa73dfa260a868c4e30efd92b3259406f645fc50e0449b89aeab8827d32c4c725dd2f971f
SSDEEP

196608:nWxLkNZONFiVDfWpugrukEa3bwQLWnhLQusRQR7p+2+E:nELkNZONFMUFruxoNazsRO7pJt

Score

10^/10

fatalrat gh0strat bootkit infostealer persistence rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/4324-327-0x00000000044C0000-0x000000000460D000-memory.dmp	family_gh0strat
behavioral2/memory/4324-328-0x00000000044C0000-0x000000000460D000-memory.dmp	family_gh0strat
behavioral2/memory/4324-335-0x00000000040C0000-0x00000000040D2000-memory.dmp	family_gh0strat
behavioral2/memory/4324-336-0x00000000040C0000-0x00000000040D2000-memory.dmp	family_gh0strat
behavioral2/memory/4324-341-0x0000000007BC0000-0x0000000007BDA000-memory.dmp	family_gh0strat
behavioral2/memory/4324-342-0x0000000007BC0000-0x0000000007BDA000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Fatal Rat payload 2 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/64-262-0x00000000034E0000-0x000000000350A000-memory.dmp	fatalrat
behavioral2/memory/4324-296-0x0000000003370000-0x000000000339A000-memory.dmp	fatalrat

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3672-272-0x0000000000280000-0x0000000000823000-memory.dmp	upx
behavioral2/files/0x000700000002347c-269.dat	upx
behavioral2/memory/3672-309-0x0000000000280000-0x0000000000823000-memory.dmp	upx
behavioral2/memory/3672-323-0x0000000000280000-0x0000000000823000-memory.dmp	upx
behavioral2/memory/4324-327-0x00000000044C0000-0x000000000460D000-memory.dmp	upx
behavioral2/memory/4324-324-0x00000000044C0000-0x000000000460D000-memory.dmp	upx
behavioral2/memory/4324-328-0x00000000044C0000-0x000000000460D000-memory.dmp	upx
behavioral2/memory/4324-335-0x00000000040C0000-0x00000000040D2000-memory.dmp	upx
behavioral2/memory/4324-336-0x00000000040C0000-0x00000000040D2000-memory.dmp	upx
behavioral2/memory/4324-332-0x00000000040C0000-0x00000000040D2000-memory.dmp	upx
behavioral2/memory/3672-337-0x0000000000280000-0x0000000000823000-memory.dmp	upx
behavioral2/memory/4324-341-0x0000000007BC0000-0x0000000007BDA000-memory.dmp	upx
behavioral2/memory/4324-338-0x0000000007BC0000-0x0000000007BDA000-memory.dmp	upx
behavioral2/memory/4324-342-0x0000000007BC0000-0x0000000007BDA000-memory.dmp	upx
behavioral2/memory/3672-354-0x0000000000280000-0x0000000000823000-memory.dmp	upx

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	720	msiexec.exe
6	720	msiexec.exe
8	720	msiexec.exe
47	2636	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WPS.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	thelper.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF920.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB92.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF514.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF66E.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF33B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f117.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF30C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF61F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD0D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f117.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD0C.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
820	MSIFD0C.tmp
1336	MSIFD0B.tmp
64	thelper.exe
3672	WPS.exe
4324	thelper.exe

Loads dropped DLL 40 IoCs

pid	Process
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
2636	MsiExec.exe
692	MsiExec.exe
692	MsiExec.exe
2636	MsiExec.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
64	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2572	4324	WerFault.exe	107
2192	4324	WerFault.exe	107

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a79acd07d3da1f660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a79acd070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a79acd07000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da79acd07000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a79acd0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	thelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	thelper.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	MsiExec.exe
2636	MsiExec.exe
4800	msiexec.exe
4800	msiexec.exe
3672	WPS.exe
3672	WPS.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe
4324	thelper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	4800	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe
Token: SeLockMemoryPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeMachineAccountPrivilege	720	msiexec.exe
Token: SeTcbPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeLoadDriverPrivilege	720	msiexec.exe
Token: SeSystemProfilePrivilege	720	msiexec.exe
Token: SeSystemtimePrivilege	720	msiexec.exe
Token: SeProfSingleProcessPrivilege	720	msiexec.exe
Token: SeIncBasePriorityPrivilege	720	msiexec.exe
Token: SeCreatePagefilePrivilege	720	msiexec.exe
Token: SeCreatePermanentPrivilege	720	msiexec.exe
Token: SeBackupPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeDebugPrivilege	720	msiexec.exe
Token: SeAuditPrivilege	720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	720	msiexec.exe
Token: SeChangeNotifyPrivilege	720	msiexec.exe
Token: SeRemoteShutdownPrivilege	720	msiexec.exe
Token: SeUndockPrivilege	720	msiexec.exe
Token: SeSyncAgentPrivilege	720	msiexec.exe
Token: SeEnableDelegationPrivilege	720	msiexec.exe
Token: SeManageVolumePrivilege	720	msiexec.exe
Token: SeImpersonatePrivilege	720	msiexec.exe
Token: SeCreateGlobalPrivilege	720	msiexec.exe
Token: SeBackupPrivilege	4588	vssvc.exe
Token: SeRestorePrivilege	4588	vssvc.exe
Token: SeAuditPrivilege	4588	vssvc.exe
Token: SeBackupPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
720	msiexec.exe
720	msiexec.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3276	4800	msiexec.exe	98
PID 4800 wrote to memory of 3276	4800	msiexec.exe	98
PID 4800 wrote to memory of 2636	4800	msiexec.exe	100
PID 4800 wrote to memory of 2636	4800	msiexec.exe	100
PID 4800 wrote to memory of 2636	4800	msiexec.exe	100
PID 4800 wrote to memory of 692	4800	msiexec.exe	102
PID 4800 wrote to memory of 692	4800	msiexec.exe	102
PID 4800 wrote to memory of 692	4800	msiexec.exe	102
PID 4800 wrote to memory of 820	4800	msiexec.exe	103
PID 4800 wrote to memory of 820	4800	msiexec.exe	103
PID 4800 wrote to memory of 820	4800	msiexec.exe	103
PID 4800 wrote to memory of 1336	4800	msiexec.exe	104
PID 4800 wrote to memory of 1336	4800	msiexec.exe	104
PID 4800 wrote to memory of 1336	4800	msiexec.exe	104
PID 64 wrote to memory of 4324	64	thelper.exe	107
PID 64 wrote to memory of 4324	64	thelper.exe	107
PID 64 wrote to memory of 4324	64	thelper.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\WPS办公软件 v76.23.66.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 98BEABFB145F100AD477D626AC74BEC5
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBD8552FA1BAC98B26A8A7A1A0818B38 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:692
- C:\Windows\Installer\MSIFD0C.tmp
  "C:\Windows\Installer\MSIFD0C.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\Installer\MSIFD0B.tmp
  "C:\Windows\Installer\MSIFD0B.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\WPS.exe"
  2⤵
  - Executes dropped EXE
  PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\ProgramData\Microsoft\MF\thelper.exe
"C:\ProgramData\Microsoft\MF\thelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\thelper.exe
  "C:\Users\Admin\AppData\Local\thelper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1800
    3⤵
    - Program crash
    PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1808
    3⤵
    - Program crash
    PID:2192

C:\Users\Admin\AppData\Roaming\WPS.exe
"C:\Users\Admin\AppData\Roaming\WPS.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4324 -ip 4324
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4324 -ip 4324
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f11a.rbs

Filesize
377KB

MD5
6eed5b799d8a46791af229bdc89f282b

SHA1
4c9dd7d8a1d0ddf21215febcfc16ab32f4789387

SHA256
2053c77edb49188e2b61b70fb842296b0207ff5531e2e40ae93a5be42cf698af

SHA512
b2a216a4d54db5aae108f90c0fa0f755d8fbb6d32bda870836bcc5d3ff8a7e94f5354420a0dcd13ef6c7675ec8f923f2ab528694953d429f9af4768753779c8f

Download Submit
C:\ProgramData\Microsoft\MF\Mi.jpg

Filesize
199KB

MD5
75cbb4f1e63e245bd3462cab5cb5be2c

SHA1
2961f8579ed879cdc1bd50dde56c6441965818ed

SHA256
dec9df011a3ee5fb9a9544bda976eec41667f344bc0b3166392f4cfffaf3f7c6

SHA512
f7620741cf450da09981f8fc8449d79981490696b84b65f35354f5be7d0d3a6ed6ce8a08334e50f5b9d81ddaaebe30b4fdb6da6fd8015b0270477d761e2ee642

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO.dll

Filesize
900KB

MD5
a06090c5f2d3df2cedc51cc99e19e821

SHA1
701ac97c2fd140464b234f666a0453d058c9fabf

SHA256
64ffdffb82fc649e6847b3c4f8678d9cca0d5117fa54c9abbb746625d3feef89

SHA512
541804db74a25fc5f50801f23b4d9f2be788d3c95d3d23dd8098f4c8888d1fc808e6eb6959c458965c639ea28b594a87dff7f3a89c4750c109b29b573c4535cf

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO2.DLL

Filesize
209KB

MD5
1bc7af7a8512cf79d4f0efc5cb138ce3

SHA1
68fd202d9380cacd2f8e0ce06d8df1c03c791c5b

SHA256
ef474b18f89310c067a859d55abd4e4f42fdac732e49eafe4246545e36872a62

SHA512
84de4d193d22a305be2ba28fc67bd1cccf83616cead721e57347f1b2e0736d351fef1abf168f7914caa1bcc7a72db43769991016673cd4646def544802ee8960

Download Submit
C:\ProgramData\Microsoft\MF\XLGraphic.dll

Filesize
730KB

MD5
74c75ae5b97ad708dbe6f69d3a602430

SHA1
a02764d99b44ce4b1d199ef0f8ce73431d094a6a

SHA256
89fbb6b1ca9168a452e803dbdc6343db7c661ad70860a245d76b3b08830156e2

SHA512
52c5f7e00dffb1c0719d18184da2cc8ec2ad178b222775f167b87320f0683a3c2846e30190bc506f12d14c07fa45896935b3d4ac396baa14d7564996e35c2ada

Download Submit
C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll

Filesize
249KB

MD5
5362cb2efe55c6d6e9b51849ec0706b2

SHA1
d91acbe95dedc3bcac7ec0051c04ddddd5652778

SHA256
1d7519acca9c8a013c31af2064fbc599a0b14cfd1dfb793a345fab14045fed40

SHA512
dbd591c3d0b9847d9cef59277c03ec89e246db0e54b58fbbe9d492b75cdcb32d75444012cdfb1c77376d15db7fde1f74e694d2487c481ce29a2133342b91e1f5

Download Submit
C:\ProgramData\Microsoft\MF\XLUE.dll

Filesize
2.4MB

MD5
0abbe96e1f7a254e23a80f06a1018c69

SHA1
0b83322fd5e18c9da8c013a0ed952cffa34381ae

SHA256
10f099f68741c179d5ad60b226d15233bb02d73f84ce51a5bbbbc4eb6a08e9d4

SHA512
2924e1e11e11bd655f27eb0243f87002a50a2d4b80e0b0e3ad6fd4c3d75c44222fab426fcaa695881b0093babf544e8aeee50a065ea92274145b0f88b1db0c58

Download Submit
C:\ProgramData\Microsoft\MF\ic.dll

Filesize
1.6MB

MD5
bb1197bea58b158554fa3fa25866d1ea

SHA1
cae7f395ed42fa2dd3362f4c816fb678072feb49

SHA256
20a04729fdd8e02e2fb5be79af130c364d0f3ce85e49478a6819a0a2020ae844

SHA512
f80b7669da861400a5b5add8148b85cc62994819e3a3a2220475d7ec2fc31f70bc3c683d5a5d6043b319b428a0ac47b9b41201aee7aba5d5cc927a8556dd7b73

Download Submit
C:\ProgramData\Microsoft\MF\libexpat.dll

Filesize
668KB

MD5
5ff790879aab8078884eaac71affeb4a

SHA1
59352663fdcf24bb01c1f219410e49c15b51d5c5

SHA256
cceca70f34bbcec861a02c3700de79ea17d80c0a7b9f33d7edd1357a714e0f2f

SHA512
34fbaffc48912e3d3fa2d224e001121e8b36f5be7284a33eb31d306b9a5c00de6e23a9fdc1a17a61fb1371768f0b0e30b9c6e899a08c735fc70482d5aa8ea824

Download Submit
C:\ProgramData\Microsoft\MF\libpng13.dll

Filesize
157KB

MD5
bb1922dfbdd99e0b89bec66c30c31b73

SHA1
f7a561619c101ba9b335c0b3d318f965b8fc1dfb

SHA256
76457f38cbbdd3dce078a40d42d9ac0dc26ae1c4bb68ab9c880eb7ffb400fd99

SHA512
3054574dd645feb1468cee53db2fd456e4f923eaf5fd686557a01c72c0572b19d70f3885d47fe42e97cdf7ccc2c674a6e966ff19668907cf7828e0a943cf474a

Download Submit
C:\ProgramData\Microsoft\MF\mt.dll

Filesize
1.5MB

MD5
9ded3fdffb0ff7f62e6a0a7f996c0caf

SHA1
fcc959b28a32923ccdb1ca4e304c74a31dede929

SHA256
87aab1db611adb132f503c08c32dc4efc23c9216d97e918f7279f86920701c93

SHA512
a7e7cb96a78827b01e71c595ca0d106eaf7afe35d4a548e5beccf0b009cc02d33274822958dca4998a427d8b4027eaefe99b40b3648e24730c81df34eab32ba0

Download Submit
C:\ProgramData\Microsoft\MF\thelper.exe

Filesize
226KB

MD5
17749f66292f190ef93652eb512c5ab7

SHA1
e2f651aa9d37404063ffc79e920787c9d3e71fdb

SHA256
0aa17ee66b8dae520e82a94388b1a1d603ec2aed20c464d6cac9a521d4167f24

SHA512
2ef192a191dc40a16c9b8768e749175c1a57319ab896809691effcc5de61c4a38fd8a8388b8907a1985e505907a8529f4d10990e362831092c75dafb8900b13e

Download Submit
C:\ProgramData\Microsoft\MF\zlib1.dll

Filesize
62KB

MD5
37163aacc5534fbab012fb505be8d647

SHA1
73de6343e52180a24c74f4629e38a62ed8ad5f81

SHA256
0a6357a8852daaafe7aed300e2f7e69d993cac4156e882baa8a3a56b583255ba

SHA512
c3bed1c9bc58652ed16b162ed16a93cf7479a0492db7e6ea577001dbe859affc0b20387d93d23e06e73f49f395e4c9a5a07680f000ebb82d32269742c16a5242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_36810BBF1FC90A1703AE6CC64773484E

Filesize
1KB

MD5
ef8443c274a75f80f7f1892c721e1d90

SHA1
f89d27cf179b947a03e3be6ae64443a119936376

SHA256
018be8b9f2bed0897779b6c4c3d2c6f280bf43a605dfbf760167fc299dc75922

SHA512
804e0d5d6cfbf846ce86b5a1cd647fbc77c7d0adf20052a1d4daabf01415f990605a221343eca6ef6236271c21ad88ccf42632ad0bafee10e82bf176605919fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
00be8f83f159042d4fd742612cc7917e

SHA1
f5d75a7d95f75ebdbcf485f37fdca7d3d0944a5b

SHA256
8298d825da8156290d54a697e01d6440d251a7c4fbc5f2d327c5141734c48051

SHA512
e1f9455b3d07d51bbd84968830f97b773639eae24988a83cb55eaf77020f9d3e0d3e472ac802af7f25c43595a05c82efd423e1b3ef0e43816836a24ee256463d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_36810BBF1FC90A1703AE6CC64773484E

Filesize
536B

MD5
71a1dc14df9850a61bf3b5ec743924df

SHA1
8497234a8f440ba11e30ffa00d16db900cc69a88

SHA256
574d0adcf45d040bb8c1be8313adfaa27f409d0a183830a573f04ac9dd795088

SHA512
b341094552ef0aedb167e415829cff72fa4a32a9a477b7fdf316bb95838924f216761eee38979ab2211dd98ea781be9bf91af1fdb6776c8b70dca6781dcf34b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
546edefaf9f5eb4b13a94ac23d5ce8cb

SHA1
28cbebbfad17dcf11ecd535ce64ea6ff492513b6

SHA256
807e4cd9fc6d5b878c84f52101d0623481b44987b6224f5ee5021025755cdc4d

SHA512
6e3f9388ad3bb716494b899e86ca3737f3d577a41655d5a6b2a68e715a7871a41fd5a2fd02d86221694ef115bf56a3febd6c61fd9a395ea438cf1bd7bc1084ea

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\tracking.ini

Filesize
84B

MD5
946939b2535506bbe0b5f8550589044c

SHA1
55f137185d2067bbd591888f5ff50424e181a9cd

SHA256
8f4fadee86b347af9c94adb7ec7fd4b2c6fbc8f7df7e03ff250a6cde857ac788

SHA512
abb53cc1003fcdf8badd0f45802532cf4c33b9985bc5a6e0edae645b5f9d50890290c69a1a6f9571b72853d2b6e6249b8f5345e7786c4d756c261b6eb1d5a45e

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\tracking.ini

Filesize
84B

MD5
7d7c7560084659ad9afa3282e963b49f

SHA1
94ba281ad2950fca322313e472de3467cda3edc9

SHA256
c5ed718d6ff7c39b8442246ebb40fb267f26577edd5d9121adf6a8775d716ea1

SHA512
47d65ad9239049fde0915d183ddfe277473c0de5c53d319d5d0f45de39bda4e9709a6b600fd3e902b6757166327ed476958662210c7f095f775c5361468e7308

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\{5E919E29-9B6D-46B5-ADE9-37A9610A3948}.session

Filesize
1KB

MD5
d02804798ca61e5dd50f87fd0fbf3acf

SHA1
aa3c2f748092fcfb9e9394b7c29116766af016f1

SHA256
d5fd7cbda5d5d769273d3f1929d9e2033384aaebbd76d45cdbe2d886dd2864aa

SHA512
eeb45cbd768e57e66acd354d8a1f97ba4fa9d94a074807a8c285f3d3f0e0931e1d0dcadf65fada1f116cbac056912c9b6fe3a02837e5179c034b6677f9b72697

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\{5E919E29-9B6D-46B5-ADE9-37A9610A3948}.session

Filesize
4KB

MD5
af1a0cada6db6d8e7b1f9c35f25690d8

SHA1
9d64e93838eed58741da06b0c124c814d59eaf67

SHA256
d42405d3ce717e07f5d6f23ca07f993633745a4752349ab155a9243eb19a2f90

SHA512
b50f0993f0f7699d76ad92496f06ef06b096e28562863e7678aa9f4f835a070d87ba1bb3dce9467e3bbc5a90723f601a1e4963c6acc3511a7ba04439c80e2eb4

Download Submit
C:\Users\Admin\AppData\Roaming\WPS.exe

Filesize
2.9MB

MD5
b52ba2b99108c496389ae5bb81fa6537

SHA1
9073d8c4a1968be24357862015519f2afecd833a

SHA256
c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

SHA512
6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

Download Submit
C:\Windows\Installer\MSIF1C2.tmp

Filesize
770KB

MD5
356fc2c181cc37e3f8ae4d6b855ebfcb

SHA1
2ead1e69f14099ae33a3216a9312c88007b73cd1

SHA256
c92b2d9623f19f8acfeac5fd894346515631ebb590e68f22c40a35fbacbef03c

SHA512
74ea73d3206ba1c6f1963caa4866589fe86636f68815c74733644ad6c4913de3f1399770f6095a48c9d94a7d934072d8d8b409a393de644265f6e456455dcebd

Download Submit
C:\Windows\Installer\MSIF30C.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF3CA.tmp

Filesize
897KB

MD5
6189cdcb92ab9ddbffd95facd0b631fa

SHA1
b74c72cefcb5808e2c9ae4ba976fa916ba57190d

SHA256
519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

SHA512
ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

Download Submit
C:\Windows\Installer\MSIF920.tmp

Filesize
187KB

MD5
f11e8ec00dfd2d1344d8a222e65fea09

SHA1
235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

SHA256
775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

SHA512
6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

Download Submit
C:\Windows\Installer\MSIFD0B.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
memory/64-270-0x0000000071F80000-0x0000000072197000-memory.dmp

Filesize
2.1MB

Download
memory/64-271-0x0000000071D40000-0x0000000071F74000-memory.dmp

Filesize
2.2MB

Download
memory/64-282-0x0000000071F80000-0x0000000072197000-memory.dmp

Filesize
2.1MB

Download
memory/64-281-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/64-237-0x0000000001750000-0x0000000001858000-memory.dmp

Filesize
1.0MB

Download
memory/64-257-0x0000000003480000-0x00000000034B1000-memory.dmp

Filesize
196KB

Download
memory/64-240-0x0000000001860000-0x0000000001AD6000-memory.dmp

Filesize
2.5MB

Download
memory/64-243-0x00000000012C0000-0x00000000012F5000-memory.dmp

Filesize
212KB

Download
memory/64-262-0x00000000034E0000-0x000000000350A000-memory.dmp

Filesize
168KB

Download
memory/64-283-0x0000000071D40000-0x0000000071F74000-memory.dmp

Filesize
2.2MB

Download
memory/64-252-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/3672-272-0x0000000000280000-0x0000000000823000-memory.dmp

Filesize
5.6MB

Download
memory/3672-309-0x0000000000280000-0x0000000000823000-memory.dmp

Filesize
5.6MB

Download
memory/3672-323-0x0000000000280000-0x0000000000823000-memory.dmp

Filesize
5.6MB

Download
memory/3672-337-0x0000000000280000-0x0000000000823000-memory.dmp

Filesize
5.6MB

Download
memory/3672-354-0x0000000000280000-0x0000000000823000-memory.dmp

Filesize
5.6MB

Download
memory/4324-301-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4324-330-0x00000000723B0000-0x00000000725C7000-memory.dmp

Filesize
2.1MB

Download
memory/4324-302-0x00000000723B0000-0x00000000725C7000-memory.dmp

Filesize
2.1MB

Download
memory/4324-296-0x0000000003370000-0x000000000339A000-memory.dmp

Filesize
168KB

Download
memory/4324-292-0x0000000003330000-0x0000000003361000-memory.dmp

Filesize
196KB

Download
memory/4324-290-0x00000000018A0000-0x00000000018D5000-memory.dmp

Filesize
212KB

Download
memory/4324-327-0x00000000044C0000-0x000000000460D000-memory.dmp

Filesize
1.3MB

Download
memory/4324-324-0x00000000044C0000-0x000000000460D000-memory.dmp

Filesize
1.3MB

Download
memory/4324-328-0x00000000044C0000-0x000000000460D000-memory.dmp

Filesize
1.3MB

Download
memory/4324-329-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4324-331-0x0000000072170000-0x00000000723A4000-memory.dmp

Filesize
2.2MB

Download
memory/4324-303-0x0000000072170000-0x00000000723A4000-memory.dmp

Filesize
2.2MB

Download
memory/4324-335-0x00000000040C0000-0x00000000040D2000-memory.dmp

Filesize
72KB

Download
memory/4324-336-0x00000000040C0000-0x00000000040D2000-memory.dmp

Filesize
72KB

Download
memory/4324-332-0x00000000040C0000-0x00000000040D2000-memory.dmp

Filesize
72KB

Download
memory/4324-288-0x0000000001450000-0x000000000148F000-memory.dmp

Filesize
252KB

Download
memory/4324-341-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Filesize
104KB

Download
memory/4324-338-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Filesize
104KB

Download
memory/4324-342-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Filesize
104KB

Download
memory/4324-344-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4324-345-0x00000000723B0000-0x00000000725C7000-memory.dmp

Filesize
2.1MB

Download
memory/4324-346-0x0000000072170000-0x00000000723A4000-memory.dmp

Filesize
2.2MB

Download
memory/4324-286-0x0000000001790000-0x0000000001898000-memory.dmp

Filesize
1.0MB

Download