Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2024 06:20

General

  • Target

    YoudaoDict_fanyiweb_navigation.msi

  • Size

    114.3MB

  • MD5

    8634adb0215e3a90751fb0cbca90becd

  • SHA1

    4d3cd1399e78730ebcb46bd0d6a6ad6a5dc1e620

  • SHA256

    2c612c1987f1932d71b725d7294fd5d81aba0476ec0948812a54ff0a9db4c53c

  • SHA512

    4e9d823e71a7be6251aac61c67641acd8a2c14fb227de9a45c7cf3d6a7cc9289e13457dbfe2c79ac8c8dd78e84f4798e98f484c5b4329f1c06424119fa375dcd

  • SSDEEP

    3145728:UYP/W8g21cAIPkqjyInzEmbMUo0B2TPZVxLR:U+HgOcPsq/VMjg2NN

Malware Config

Signatures

  • Detect PurpleFox Rootkit 3 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1520
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3336
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 74F28E4E1950251EB2197419CD352485 E Global\MSI0000
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe
        "C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe" x "C:\Program Files\ExpandConnectorHappy\MfwQXuOCukyLkKcAGzRa" -o"C:\Program Files\ExpandConnectorHappy\" -pmGBkxYsXraIZsNILlsWU -y
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1668
      • C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe
        "C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe" -number 150 -file file3 -mode mode3 -flag flag3
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4836
      • C:\Program Files\ExpandConnectorHappy\YoudaoDict_fanyiweb_navigation.exe
        "C:\Program Files\ExpandConnectorHappy\YoudaoDict_fanyiweb_navigation.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:764
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3704
  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe
    "C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe" install
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    PID:2672
  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe
    "C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe" start
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    PID:4800
  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe
    "C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe"
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe
      "C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe" -number 155 -file file3 -mode mode3 -flag flag3
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe
        "C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe" -number 362 -file file3 -mode mode3 -flag flag3
        3⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57ff02.rbs

    Filesize

    7KB

    MD5

    44e6b97abf8d1327ba3f1c8a9c0c1194

    SHA1

    ddbe57c3cf6e4e7b43acafe96ee37c60715a113f

    SHA256

    4b7dc932d06b2a2863894aeaaecabc4bc91ef39ef40690f5957ccad55c154d71

    SHA512

    5467f627f31b329f3a537ab4a694c1baff1270e9abc42df1a68f2c1f05b5518ccde917833e905260184bd87be9b425fd5ffae683e9688651a2583298f2c235b6

  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.exe

    Filesize

    832KB

    MD5

    d305d506c0095df8af223ac7d91ca327

    SHA1

    679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

    SHA256

    923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

    SHA512

    94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.wrapper.log

    Filesize

    264B

    MD5

    5d7bf694ce1f8f7f8f3a0c2d575104a8

    SHA1

    ef6fa8dc6ed08263371ffc1f0ec6ae34f8e905e5

    SHA256

    3d04ce69e44c090b6cab5c172a255faabd78a4b601609169361a8a186d84b3ad

    SHA512

    4098550c6749eb542f6af7a6ade8bcbe9175f15971c2682e93a94f1677638fade5c0f715793f3d156dafea316c8df2a5dac4106e756fe9b4d215b7534f3b64bd

  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.wrapper.log

    Filesize

    419B

    MD5

    54aec951904847ffa6b9844caef21363

    SHA1

    475aa6359528d2708c73d491deefbbfbe8310962

    SHA256

    2b37b894e6e53e4ea8e220bee8fa19e294e2a49a74b632ab77c4cd3c6b4ab1cf

    SHA512

    04c318170433ce214d2fcee3b74d896a04541c42dd733defd4e6d995744f4372bd0c5a617e144c564b0831a30e339a7317472abddef28ed2a4e0e99b49f99a22

  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.wrapper.log

    Filesize

    584B

    MD5

    3d219c20a9561fe691650451ba63e6cc

    SHA1

    6185c7911a5acdb2d804cdbc01d36b87b7a174cf

    SHA256

    f110835b30b10b5526c539c3c0dd49acf8786db5063cc4219eef2f389ca42fa3

    SHA512

    9d6ed6cbff39f2054b93a4fbf5eec116d4421d0ca71f76c8e683ce3d15f2bdbf827fe0b7763d21033678a7469ccd73ba4d6330d508662cc7f395836d92634291

  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.wrapper.log

    Filesize

    728B

    MD5

    876caec61cd62b389749238f18138363

    SHA1

    f8cea6e7f6353a54a9b888547a06c9094e4fd9bb

    SHA256

    b821e17c8b13bdf5278deea3375ac537c3e7b7dc5b0c8b615203325f63cefd04

    SHA512

    057640f8a647cad2e5bd1250a5a6754f01b7c8eedc3a62624d19f91ad4b429716bb9799a5ab4da06fc7c91eae2afb94e1683188ebd5f7cc71cf7629817a18fc4

  • C:\Program Files\ExpandConnectorHappy\EYbkmfmiNjLT.xml

    Filesize

    435B

    MD5

    19a27351b13b551a41e93bd6a57ea8de

    SHA1

    f5f51862b5de14714e6d815cdee7e6a1f2bc1208

    SHA256

    1a777cdbcf83ab27cfe86df9993bb4e7bc37ed22a44c5c6311b3d2d72758b6cf

    SHA512

    b27404ac93a25d7bdf9f30720ab77f36ba41d58155d8f541ddab2034a93ced93202d7b8bf20a7615bee70ef617ae13978f1ff9c13f92f636fce64868c895f282

  • C:\Program Files\ExpandConnectorHappy\MfwQXuOCukyLkKcAGzRa

    Filesize

    1.9MB

    MD5

    06fd2e4e815c5f57748835bace0a2b41

    SHA1

    049e1690422249659e7b4e0ee9e118ad5db9e080

    SHA256

    ed089d47b597d2cf4a712a0d3545dcd17a7ec52955525d9c337c6aa5a032ee40

    SHA512

    343d7ce78f325bb5876e278a06cfb122cb14b6e46b2a6f0de7a874fa8fea9fa743e0447f6ceae6922ed8c5116248bde0129f53a7549a944599311a049b7806ff

  • C:\Program Files\ExpandConnectorHappy\ekWKvevMHU4.exe

    Filesize

    3.2MB

    MD5

    e8aac7ae25fadc0cdac93ea19c6b4aeb

    SHA1

    1c78766f43e23add4768dfffe2624510ce71d50d

    SHA256

    2dfaf798d43d3f7a873a3127678465d7b6fca11f68b6aa01c6ef34a7bfcdfaa9

    SHA512

    2fe1ec405cd8a4a2bb0326d715f7a14134876e18e879f48129fd9751852c2866400cb5b0b6406b78648072e49cf00a73eeb3aba5849f2fab23d4443b292d8f91

  • C:\Program Files\ExpandConnectorHappy\vsIUYhBxXQGE.exe

    Filesize

    574KB

    MD5

    42badc1d2f03a8b1e4875740d3d49336

    SHA1

    cee178da1fb05f99af7a3547093122893bd1eb46

    SHA256

    c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    SHA512

    6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\LockedList.dll

    Filesize

    95KB

    MD5

    5a94bf8916a11b5fe94aca44886c9393

    SHA1

    820d9c5e3365e323d6f43d3cce26fd9d2ea48b93

    SHA256

    0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d

    SHA512

    79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\OP_WndProc.dll

    Filesize

    48KB

    MD5

    765cf74fc709fb3450fa71aac44e7f53

    SHA1

    b423271b4faac68f88fef15fa4697cf0149bad85

    SHA256

    cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e

    SHA512

    0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\SkinBtn.dll

    Filesize

    4KB

    MD5

    29818862640ac659ce520c9c64e63e9e

    SHA1

    485e1e6cc552fa4f05fb767043b1e7c9eb80be64

    SHA256

    e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb

    SHA512

    ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\System.dll

    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\btn_agree.bmp

    Filesize

    38KB

    MD5

    dab018047c171165c18329d5c59b617e

    SHA1

    88848ac4aceb7358f13d225de6d4fd0a5696517a

    SHA256

    1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734

    SHA512

    1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\btn_disagree.bmp

    Filesize

    38KB

    MD5

    5f7b90c87ea0517771862fae5f11ce94

    SHA1

    fc9f195e888d960139278c04a0e78996c6442d5b

    SHA256

    f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2

    SHA512

    dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\checkbox_null.bmp

    Filesize

    3KB

    MD5

    5754c67775c3f4f50a4780b3bca026b1

    SHA1

    3e95c72c13d6175ef275280fe270d678acee46e9

    SHA256

    2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739

    SHA512

    df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    4ccc4a742d4423f2f0ed744fd9c81f63

    SHA1

    704f00a1acc327fd879cf75fc90d0b8f927c36bc

    SHA256

    416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

    SHA512

    790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

  • C:\Users\Admin\AppData\Local\Temp\nsp10F5.tmp\slide8.bmp

    Filesize

    908KB

    MD5

    6d20c27bc3168af9c076b459f1da05dc

    SHA1

    d49795bc5ec392f5da3a65958bc8bd2dbaaddcfe

    SHA256

    da8894cbad7c440ad992416421611071d9b82cda3a3c8287f7c1d75c0386f468

    SHA512

    e4233a72e59bd1f7ee0dc4559ef06b360025e52414c2d6f4ee317e5c193109c1e4be70fc89e74e4a6061035c7e18b97e61ab96716b4ab0ab997b178bcef9d7bb

  • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EYbkmfmiNjLT.exe.log

    Filesize

    1KB

    MD5

    122cf3c4f3452a55a92edee78316e071

    SHA1

    f2caa36d483076c92d17224cf92e260516b3cbbf

    SHA256

    42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

    SHA512

    c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

    Filesize

    23.7MB

    MD5

    bd46a02ae178e2a010ac9376e4480f2f

    SHA1

    ab5401d63d08c875e0fca989fc81cb4d7730d635

    SHA256

    dac2e1b94c16640648cc503da7c76b23b816c58a646f97cd15427f74546d1ccf

    SHA512

    17ff402ad77a52f37a82140f58c08fec88e6cb3c1e51752875b372681e797ab3853ea58ded0c0f2761f49785c760ccc6c3b439028d7ea9a2c874c372f03a015a

  • \??\Volume{8484aac9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{972017d5-42c4-4672-9ae9-56a6ac1fbcad}_OnDiskSnapshotProp

    Filesize

    6KB

    MD5

    817ebca354062a01b5b9757e48535742

    SHA1

    34e0fac410d2492d2fd37e540f344eaa15ea0441

    SHA256

    c435351afb1a53eeb833090ef78ec3ce21380aa5091de4c6b3a5a8878c1fbf34

    SHA512

    a352b1b7d64ec2a0f656edd5940710e9ede48c6ab931468e35251981c13217178937ade1aa7b300d2386708cc2ac831962a6d50cbcc509bc81270800d2b38428

  • memory/2672-30-0x00000000003B0000-0x0000000000486000-memory.dmp

    Filesize

    856KB

  • memory/3120-166-0x000000002B5D0000-0x000000002B60E000-memory.dmp

    Filesize

    248KB

  • memory/3120-167-0x000000002BA40000-0x000000002BBFB000-memory.dmp

    Filesize

    1.7MB

  • memory/3120-169-0x000000002BA40000-0x000000002BBFB000-memory.dmp

    Filesize

    1.7MB

  • memory/3120-170-0x000000002BA40000-0x000000002BBFB000-memory.dmp

    Filesize

    1.7MB

  • memory/4836-27-0x0000000029C60000-0x0000000029C87000-memory.dmp

    Filesize

    156KB