Malware Analysis Report

2024-12-07 13:40

Sample ID 241107-np1yfa1gja
Target 55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi.vir
SHA256 55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b
Tags
gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b

Threat Level: Known bad

The file 55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi.vir was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan

Purplefox family

Gh0strat

Gh0strat family

Gh0st RAT payload

PurpleFox

Detect PurpleFox Rootkit

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Executes dropped EXE

Drops file in Windows directory

Loads dropped DLL

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 11:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 11:35

Reported

2024-11-07 11:38

Platform

win7-20240903-en

Max time kernel

148s

Max time network

147s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\Gwogw.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Gwogw.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Gwogw.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF8E7.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76f190.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF547.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF604.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF827.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF8C5.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76f193.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76f190.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF5B5.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76f193.ipi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSIF8C5.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSIF8E7.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\Gwogw.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\Gwogw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\Gwogw.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\Gwogw.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\Gwogw.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\Gwogw.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Gwogw.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 2568 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 3020 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8C5.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 2740 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIF8E7.tmp
PID 7840 wrote to memory of 4088 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 7840 wrote to memory of 4088 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 7840 wrote to memory of 4088 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 7840 wrote to memory of 4088 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4020 wrote to memory of 13212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 89C027F8C7FC0B204252716EA7465399

C:\Windows\Installer\MSIF8C5.tmp

"C:\Windows\Installer\MSIF8C5.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\Installer\MSIF8E7.tmp

"C:\Windows\Installer\MSIF8E7.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe

"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
HK 206.119.124.126:1799 tcp

Files

C:\Windows\Installer\MSIF547.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Config.Msi\f76f194.rbs

MD5 fa41924d6606f682026b139f728d7d9e
SHA1 037b6cd0a5a7c2e8047997b5c98c5b0b71e7c8ea
SHA256 d711881c7f34f85d862d6d2663e9d863e58280fcafeec7f8890442513f8d4cb8
SHA512 f3f4e00fe9d4922ca396755e18fc7f4d4e3cb9135e24bd3cd1d6b799bff0ad2c752972c2daca3cba1b395e207df5c5886b9871eb300ba20e6f3faa1d88a2ad8e

C:\Windows\Installer\MSIF8C5.tmp

MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

memory/640-36-0x00000000000F0000-0x00000000000F2000-memory.dmp

memory/3020-37-0x0000000000120000-0x0000000000122000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

MD5 b0d42f500cfc5ea2d25dd408a42c4720
SHA1 0507dfd1e1d0e6fea86a415d518df06770406e75
SHA256 43982d5f68e03fabceac983c736c1ba71751ee5bed1c69899167fab3cbdc1c19
SHA512 0c22f09960b70f444accf97071225d5018156e72a74b07692208f94d9305815293758d57efb233cc6785e2a0cf54b4862d27daa67ea1458669eb4a7a7c1d4be6

memory/2896-43-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/2896-45-0x00000000025C0000-0x000000000411A000-memory.dmp

memory/2896-44-0x00000000025C0000-0x000000000411A000-memory.dmp

memory/2896-46-0x0000000075B80000-0x0000000075BC7000-memory.dmp

memory/2896-913-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-915-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-911-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-909-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-907-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-903-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-901-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-899-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-897-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-895-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-891-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-889-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-887-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-885-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-883-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-881-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-877-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-875-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-873-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-871-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-869-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-867-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-865-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-863-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-861-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-859-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-857-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-856-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-905-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-893-0x00000000041F0000-0x0000000004301000-memory.dmp

memory/2896-879-0x00000000041F0000-0x0000000004301000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nso2464.tmp\slide6.bmp

MD5 3d3ec6392cf9a8b408569a3dd4cd3ce8
SHA1 95ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256 818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512 e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505

C:\Users\Admin\AppData\Local\Temp\nso2464.tmp\OP_WndProc.dll

MD5 765cf74fc709fb3450fa71aac44e7f53
SHA1 b423271b4faac68f88fef15fa4697cf0149bad85
SHA256 cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA512 0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

\Users\Admin\AppData\Local\Temp\nso2464.tmp\LockedList.dll

MD5 5a94bf8916a11b5fe94aca44886c9393
SHA1 820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA256 0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA512 79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

C:\Users\Admin\AppData\Local\Temp\nso2464.tmp\btn_disagree.bmp

MD5 5f7b90c87ea0517771862fae5f11ce94
SHA1 fc9f195e888d960139278c04a0e78996c6442d5b
SHA256 f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512 dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

C:\Users\Admin\AppData\Local\Temp\nso2464.tmp\btn_agree.bmp

MD5 dab018047c171165c18329d5c59b617e
SHA1 88848ac4aceb7358f13d225de6d4fd0a5696517a
SHA256 1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA512 1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

C:\Users\Admin\AppData\Local\Temp\nso2464.tmp\checkbox_null.bmp

MD5 5754c67775c3f4f50a4780b3bca026b1
SHA1 3e95c72c13d6175ef275280fe270d678acee46e9
SHA256 2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512 df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

\Users\Admin\AppData\Local\Temp\nso2464.tmp\nsDialogs.dll

MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

\Users\Admin\AppData\Local\Temp\nso2464.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

\Users\Admin\AppData\Local\Temp\nso2464.tmp\SkinBtn.dll

MD5 29818862640ac659ce520c9c64e63e9e
SHA1 485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256 e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512 ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

memory/2896-17547-0x0000000000400000-0x0000000001F5A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 11:35

Reported

2024-11-07 11:38

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

150s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\Gwogw.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Gwogw.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Gwogw.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{4B2B1826-5935-494B-B7C1-90C074EA6814} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEDA3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE57E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIED83.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57e445.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e57e445.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE6C7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE801.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE8BE.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE774.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEC0B.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSIEDA3.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSIED83.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\Gwogw.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\Gwogw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\SysWOW64\Gwogw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\SysWOW64\Gwogw.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" C:\Windows\SysWOW64\Gwogw.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Gwogw.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 2004 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2896 wrote to memory of 2004 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2896 wrote to memory of 2004 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2896 wrote to memory of 3824 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIED83.tmp
PID 2896 wrote to memory of 3824 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIED83.tmp
PID 2896 wrote to memory of 3824 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIED83.tmp
PID 2896 wrote to memory of 4376 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIEDA3.tmp
PID 2896 wrote to memory of 4376 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIEDA3.tmp
PID 2896 wrote to memory of 4376 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIEDA3.tmp
PID 876 wrote to memory of 5412 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 876 wrote to memory of 5412 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 876 wrote to memory of 5412 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 12116 wrote to memory of 5308 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 12116 wrote to memory of 5308 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 12116 wrote to memory of 5308 N/A C:\Windows\SysWOW64\Gwogw.exe C:\Windows\SysWOW64\Gwogw.exe
PID 5412 wrote to memory of 14016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5412 wrote to memory of 14016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5412 wrote to memory of 14016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 16163D78A0CBC9541F3D244A20A18F31

C:\Windows\Installer\MSIED83.tmp

"C:\Windows\Installer\MSIED83.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\Installer\MSIEDA3.tmp

"C:\Windows\Installer\MSIEDA3.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe

"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
HK 206.119.124.126:1799 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 126.124.119.206.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

C:\Windows\Installer\MSIE57E.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Config.Msi\e57e448.rbs

MD5 bc3da4a92ca935f375633ce52ef59d5b
SHA1 f40ad454efda4fe99ed340db246f4ed25d3d79f7
SHA256 bc1fc6bf9152cff92c7e5df14a7b5b0355ae955b9730ac19df0277c0757387e8
SHA512 debb2e91d3528ad9719a60156db3181f2eecefc9c6791d1235be50b8076b5c00d4c13a7c3aac3d358e517fa52c9a141d283c89ad7f89729783f8ca96d9da200c

C:\Windows\Installer\MSIED83.tmp

MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

MD5 b0d42f500cfc5ea2d25dd408a42c4720
SHA1 0507dfd1e1d0e6fea86a415d518df06770406e75
SHA256 43982d5f68e03fabceac983c736c1ba71751ee5bed1c69899167fab3cbdc1c19
SHA512 0c22f09960b70f444accf97071225d5018156e72a74b07692208f94d9305815293758d57efb233cc6785e2a0cf54b4862d27daa67ea1458669eb4a7a7c1d4be6

memory/876-45-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/876-46-0x0000000077A30000-0x0000000077C45000-memory.dmp

memory/876-3922-0x0000000075EA0000-0x0000000076040000-memory.dmp

memory/876-5934-0x00000000769E0000-0x0000000076A5A000-memory.dmp

memory/876-13119-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/876-13120-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/876-13123-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/876-13121-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/876-13124-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/876-13125-0x0000000010000000-0x000000001019F000-memory.dmp

memory/12116-13136-0x0000000077A30000-0x0000000077C45000-memory.dmp

memory/12116-17010-0x0000000075EA0000-0x0000000076040000-memory.dmp

memory/12116-19019-0x00000000769E0000-0x0000000076A5A000-memory.dmp

memory/876-26204-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/12116-26205-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/12116-26208-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/12116-26207-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/12116-26206-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/12116-26210-0x0000000000400000-0x0000000001F5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\SkinBtn.dll

MD5 29818862640ac659ce520c9c64e63e9e
SHA1 485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256 e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512 ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\slide6.bmp

MD5 3d3ec6392cf9a8b408569a3dd4cd3ce8
SHA1 95ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256 818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512 e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\checkbox_null.bmp

MD5 5754c67775c3f4f50a4780b3bca026b1
SHA1 3e95c72c13d6175ef275280fe270d678acee46e9
SHA256 2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512 df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\nsDialogs.dll

MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\OP_WndProc.dll

MD5 765cf74fc709fb3450fa71aac44e7f53
SHA1 b423271b4faac68f88fef15fa4697cf0149bad85
SHA256 cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA512 0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

memory/12116-26313-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/5308-26314-0x0000000077A30000-0x0000000077C45000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\LockedList.dll

MD5 5a94bf8916a11b5fe94aca44886c9393
SHA1 820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA256 0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA512 79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\btn_disagree.bmp

MD5 5f7b90c87ea0517771862fae5f11ce94
SHA1 fc9f195e888d960139278c04a0e78996c6442d5b
SHA256 f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512 dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

C:\Users\Admin\AppData\Local\Temp\nsiF416.tmp\btn_agree.bmp

MD5 dab018047c171165c18329d5c59b617e
SHA1 88848ac4aceb7358f13d225de6d4fd0a5696517a
SHA256 1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA512 1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

memory/5308-30188-0x0000000075EA0000-0x0000000076040000-memory.dmp

memory/5308-32197-0x00000000769E0000-0x0000000076A5A000-memory.dmp

memory/5308-39383-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/5308-39384-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/5308-39387-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/5308-39385-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/5308-39388-0x0000000000400000-0x0000000001F5A000-memory.dmp

memory/5308-39404-0x0000000000400000-0x0000000001F5A000-memory.dmp