Overview

overview

10

Static

static

1

wpsupdate.msi

windows7-x64

6

wpsupdate.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 15:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wpsupdate.msi

  • Size

    17.9MB

  • MD5

    151a066813a13375522df7282f2837d8

  • SHA1

    61ff6e9d0be8681c59e8296d4d8a2b3579044858

  • SHA256

    9a6bc8d7631fe970648bc6d30c99b8764fb9f1e51fca7220799b8d3e6cfa86ea

  • SHA512

    4e101083b6df77435a857bd9c5322c16e18742b82de82dc0282ff47d104acaf475f5619b4048c59d29fb3db0006d385786e5b82e67ce132c0e87d411fec8ba5d

  • SSDEEP

    393216:/Wp84flbAgjDPLgoZr3hfE3XG1Ccu3mBe2fJpAMdLSVQvzmFE1KYo0Nw5i4hH:/UflhTgo5hM3Y2mBvxoFzd5iYH

Score
10/10
gh0stratpurplefoxbootkitdiscoverypersistenceprivilege_escalationratrootkittrojan

Malware Config

Signatures

  • Detect PurpleFox Rootkit 2 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 25 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wpsupdate.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3280
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1476
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4C7DDA8E28F17C8FB59E7D7F14585995 E Global\MSI0000
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Program Files\LaunchAdvisorUnique\jzafRqbTGRDF.exe
        "C:\Program Files\LaunchAdvisorUnique\jzafRqbTGRDF.exe" x "C:\Program Files\LaunchAdvisorUnique\sqFZEXePXWvsoVXJtAfH" -o"C:\Program Files\LaunchAdvisorUnique\" -pasvgcrJQGolJwtcpGtoH -y
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4884
      • C:\Program Files\LaunchAdvisorUnique\qPptEPZEtb29.exe
        "C:\Program Files\LaunchAdvisorUnique\qPptEPZEtb29.exe" -number 268 -file file3 -mode mode3 -flag flag3
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3436
      • C:\Program Files\LaunchAdvisorUnique\wpsupdate.exe
        "C:\Program Files\LaunchAdvisorUnique\wpsupdate.exe"
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2908
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1432
  • C:\Program Files\LaunchAdvisorUnique\qPptEPZEtb29.exe
    "C:\Program Files\LaunchAdvisorUnique\qPptEPZEtb29.exe" -file file3 -mode mode3 -flag flag3 -number 200
    1⤵
    • Enumerates connected drives
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57a29a.rbs
    Filesize

    7KB

    MD5

    c072afd241ed97af80c7c904a20aed8e

    SHA1

    3d894c06ad3449fe6541ec1bae9c08167e12ec8d

    SHA256

    40cd3e963ca389adbd454295dc01d774fa05cd4ef1205939ee20335f4705867a

    SHA512

    630ee88f93f059cdfe590189b856de87668f12e55a73c68e8f5117821be3e2f138b8ec7dd9524ab40e52ae865ecf85e5d3d3a3d509306dfc210baca7279325bb

    Download Submit

  • C:\Program Files\LaunchAdvisorUnique\jzafRqbTGRDF.exe
    Filesize

    574KB

    MD5

    42badc1d2f03a8b1e4875740d3d49336

    SHA1

    cee178da1fb05f99af7a3547093122893bd1eb46

    SHA256

    c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    SHA512

    6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

    Download Submit

  • C:\Program Files\LaunchAdvisorUnique\qPptEPZEtb29.exe
    Filesize

    2.1MB

    MD5

    03362c3b0c370e2d69835e761c3e4e39

    SHA1

    50e80b7cd693b070238e4d9b9c6fe1c4aee72ebb

    SHA256

    eb63c7b4ce832c8bc998e153ed32ef86a767402c0f68ec7d4719ffd3c35ab1dc

    SHA512

    340fcf7b6b795f21fe5dd0f144ee4bde0aef49f51eb811a6d01bb4354d0d52d90ad0a691d6f0660d74ce1c269be64a315f31deffaad967de78c8c0c035085e86

    Download Submit

  • C:\Program Files\LaunchAdvisorUnique\sqFZEXePXWvsoVXJtAfH
    Filesize

    745KB

    MD5

    1e97cf2c873236220e524271fa7c1937

    SHA1

    11318422806b64985ab81df5c0f561f12b53e240

    SHA256

    5252b5f301b1db5f73985a6134213a8353f561652001265432e7109cf87c466d

    SHA512

    fbda82c35c29c6b602ff03d39fd82a8521e2d738aa551e3128c1db76fed35ac5a9ee0b201513e8baadb31eafc0b89e7f27b32f1319cd2eb3e2de57b3e3d75f3c

    Download Submit

  • C:\Program Files\LaunchAdvisorUnique\wpsupdate.exe
    Filesize

    6.0MB

    MD5

    57dadd6a929f64c2b1efe2d52c1c4985

    SHA1

    962cb227f81f885f23826c3e040aa9dbc97659cf

    SHA256

    996b5d59cce7955b4374bd00d83c422d3a1d9ffebba59c66074c37ab28cfaeb5

    SHA512

    3f64c35e72698ea6a7e708a4367277f3ab62c27f0652e0c55bab6e02239ee37c4f0a21503c0688301fb77bbf8e59e3c5c8aa2df8d62a4ab8a9b9cdf6f0a775cf

    Download Submit

  • C:\Windows\Installer\e57a299.msi
    Filesize

    17.9MB

    MD5

    151a066813a13375522df7282f2837d8

    SHA1

    61ff6e9d0be8681c59e8296d4d8a2b3579044858

    SHA256

    9a6bc8d7631fe970648bc6d30c99b8764fb9f1e51fca7220799b8d3e6cfa86ea

    SHA512

    4e101083b6df77435a857bd9c5322c16e18742b82de82dc0282ff47d104acaf475f5619b4048c59d29fb3db0006d385786e5b82e67ce132c0e87d411fec8ba5d

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.7MB

    MD5

    2041c34467b0ff65c135fdea5e830b1e

    SHA1

    8a6c52829a3c2ffa840aff6ff35f888991bd9e34

    SHA256

    5e5639de763556e2d059914ae0af6039ba663a320d02d30944fb6315dbd3a3dd

    SHA512

    4084115fc4b457763aa69cac2c28b9fbc0f9e61e620c9ad9bde54bb4a8ff5b18e2b86edcb2b086395862f2cde1b2ed4361229d0a32cc2c5d260c65cf34c3d49b

    Download Submit

  • \??\Volume{fa3589b5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{53f5a8cd-973c-49db-b2d2-b66ba8581e79}_OnDiskSnapshotProp
    Filesize

    6KB

    MD5

    54d3471c2c2372303a4cdca2ce7dbebd

    SHA1

    afd29e4bce6e6b49b48e1512a1f96b1af061870b

    SHA256

    942f492e7d911617b8043b3e1134326ee1e57c139c80d38038be0caaeb5a9c16

    SHA512

    8dce164ec0db80d486f0416054446a6dd8ef35e8c0507ca79bee579ee56a77ab8b78e17ba90cdb7a6163328cff119c9b9e1ddb9d26ce6e34d6b4395405534129

    Download Submit

  • memory/2596-40-0x000000002B3B0000-0x000000002B56B000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2596-42-0x000000002B3B0000-0x000000002B56B000-memory.dmp

    Filesize

    1.7MB

    Download