gh0strat | 252115f874019044de7f7ebd36067537ab1e65b51ab771ec447b073fd9d6045d

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

252115f874019044de7f7ebd36067537ab1e65b51ab771ec447b073fd9d6045d.msi
Size

135.9MB
MD5

9bb81bdc5e28a397f25617a22b9e157d
SHA1

e9e78c22ff047b35c2a6691295a9df62de203df0
SHA256

252115f874019044de7f7ebd36067537ab1e65b51ab771ec447b073fd9d6045d
SHA512

dc5678fd1441a5b65792f16ffc64694029f2b70dabcb4d54908121c2267d0f34b4de83d951a656267c80e288d9b0b0030d42572a7782d45762427be07c61483d
SSDEEP

3145728:9QlSw/0KksfWneWVr6/4J3DYgxqmz8CZCLLURIq3MmzJPeHeZ:GlSw/7ksOneWVm/CDYddLYIcMeZ

Score

10^/10

gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/2572-17545-0x0000000000400000-0x0000000001F96000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2572-17545-0x0000000000400000-0x0000000001F96000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeVnfvn.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	Vnfvn.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	Vnfvn.exe
File opened (read-only)	\??\S:	Vnfvn.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	Vnfvn.exe
File opened (read-only)	\??\K:	Vnfvn.exe
File opened (read-only)	\??\Z:	Vnfvn.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	Vnfvn.exe
File opened (read-only)	\??\I:	Vnfvn.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	Vnfvn.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	Vnfvn.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	Vnfvn.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	Vnfvn.exe
File opened (read-only)	\??\Q:	Vnfvn.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	Vnfvn.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	Vnfvn.exe
File opened (read-only)	\??\M:	Vnfvn.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	Vnfvn.exe
File opened (read-only)	\??\V:	Vnfvn.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	Vnfvn.exe
File opened (read-only)	\??\Y:	Vnfvn.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	Vnfvn.exe
File opened (read-only)	\??\W:	Vnfvn.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

SoftUpdate.exe

description ioc process

File created C:\Windows\SysWOW64\Vnfvn.exe SoftUpdate.exe
File opened for modification C:\Windows\SysWOW64\Vnfvn.exe SoftUpdate.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Vnfvn.exe	SoftUpdate.exe
File opened for modification	C:\Windows\SysWOW64\Vnfvn.exe	SoftUpdate.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs

Processes:

SoftUpdate.exeVnfvn.exeVnfvn.exe

pid	process
2572	SoftUpdate.exe
2572	SoftUpdate.exe
2572	SoftUpdate.exe
2572	SoftUpdate.exe
9492	Vnfvn.exe
9492	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\f76e6c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e6c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE782.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE929.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e6c9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE88C.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e6c9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC3A.tmp	msiexec.exe

Executes dropped EXE 6 IoCs

Processes:

MSIEBF9.tmpMSIEC3A.tmpYoudaoDict_fanyiweb_navigation.exeSoftUpdate.exeVnfvn.exeVnfvn.exe

pid process

2708 MSIEBF9.tmp
2772 MSIEC3A.tmp
2880 YoudaoDict_fanyiweb_navigation.exe
2572 SoftUpdate.exe
9492 Vnfvn.exe
12596 Vnfvn.exe

pid	process
2708	MSIEBF9.tmp
2772	MSIEC3A.tmp
2880	YoudaoDict_fanyiweb_navigation.exe
2572	SoftUpdate.exe
9492	Vnfvn.exe
12596	Vnfvn.exe

Loads dropped DLL 12 IoCs

Processes:

MsiExec.exeSoftUpdate.exeYoudaoDict_fanyiweb_navigation.exe

pid	process
2504	MsiExec.exe
2504	MsiExec.exe
2504	MsiExec.exe
2572	SoftUpdate.exe
2572	SoftUpdate.exe
2572	SoftUpdate.exe
2880	YoudaoDict_fanyiweb_navigation.exe
2880	YoudaoDict_fanyiweb_navigation.exe
2880	YoudaoDict_fanyiweb_navigation.exe
2880	YoudaoDict_fanyiweb_navigation.exe
2880	YoudaoDict_fanyiweb_navigation.exe
2880	YoudaoDict_fanyiweb_navigation.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2316 msiexec.exe

pid	process
2316	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

SoftUpdate.exeVnfvn.execmd.exeYoudaoDict_fanyiweb_navigation.exeVnfvn.exePING.EXEMsiExec.exeMSIEBF9.tmpMSIEC3A.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vnfvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDict_fanyiweb_navigation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vnfvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEBF9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEC3A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

12588 cmd.exe
10500 PING.EXE

pid	process
12588	cmd.exe
10500	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Vnfvn.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vnfvn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Vnfvn.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

Vnfvn.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Vnfvn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	Vnfvn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Vnfvn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Vnfvn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vnfvn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vnfvn.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

10500 PING.EXE

pid	process
10500	PING.EXE

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

msiexec.exeVnfvn.exe

pid	process
744	msiexec.exe
744	msiexec.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe
12596	Vnfvn.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

msiexec.exemsiexec.exeSoftUpdate.exeVnfvn.exe

description	pid	process
Token: SeShutdownPrivilege	2316	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2316	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeSecurityPrivilege	744	msiexec.exe
Token: SeCreateTokenPrivilege	2316	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2316	msiexec.exe
Token: SeLockMemoryPrivilege	2316	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2316	msiexec.exe
Token: SeMachineAccountPrivilege	2316	msiexec.exe
Token: SeTcbPrivilege	2316	msiexec.exe
Token: SeSecurityPrivilege	2316	msiexec.exe
Token: SeTakeOwnershipPrivilege	2316	msiexec.exe
Token: SeLoadDriverPrivilege	2316	msiexec.exe
Token: SeSystemProfilePrivilege	2316	msiexec.exe
Token: SeSystemtimePrivilege	2316	msiexec.exe
Token: SeProfSingleProcessPrivilege	2316	msiexec.exe
Token: SeIncBasePriorityPrivilege	2316	msiexec.exe
Token: SeCreatePagefilePrivilege	2316	msiexec.exe
Token: SeCreatePermanentPrivilege	2316	msiexec.exe
Token: SeBackupPrivilege	2316	msiexec.exe
Token: SeRestorePrivilege	2316	msiexec.exe
Token: SeShutdownPrivilege	2316	msiexec.exe
Token: SeDebugPrivilege	2316	msiexec.exe
Token: SeAuditPrivilege	2316	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2316	msiexec.exe
Token: SeChangeNotifyPrivilege	2316	msiexec.exe
Token: SeRemoteShutdownPrivilege	2316	msiexec.exe
Token: SeUndockPrivilege	2316	msiexec.exe
Token: SeSyncAgentPrivilege	2316	msiexec.exe
Token: SeEnableDelegationPrivilege	2316	msiexec.exe
Token: SeManageVolumePrivilege	2316	msiexec.exe
Token: SeImpersonatePrivilege	2316	msiexec.exe
Token: SeCreateGlobalPrivilege	2316	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeIncBasePriorityPrivilege	2572	SoftUpdate.exe
Token: 33	12596	Vnfvn.exe
Token: SeIncBasePriorityPrivilege	12596	Vnfvn.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2316 msiexec.exe
2316 msiexec.exe

pid	process
2316	msiexec.exe
2316	msiexec.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

msiexec.exeVnfvn.exeSoftUpdate.execmd.exe

description	pid	process	target process
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2504	744	msiexec.exe	MsiExec.exe
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2708	744	msiexec.exe	MSIEBF9.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 744 wrote to memory of 2772	744	msiexec.exe	MSIEC3A.tmp
PID 9492 wrote to memory of 12596	9492	Vnfvn.exe	Vnfvn.exe
PID 9492 wrote to memory of 12596	9492	Vnfvn.exe	Vnfvn.exe
PID 9492 wrote to memory of 12596	9492	Vnfvn.exe	Vnfvn.exe
PID 9492 wrote to memory of 12596	9492	Vnfvn.exe	Vnfvn.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 2572 wrote to memory of 12588	2572	SoftUpdate.exe	cmd.exe
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE
PID 12588 wrote to memory of 10500	12588	cmd.exe	PING.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\252115f874019044de7f7ebd36067537ab1e65b51ab771ec447b073fd9d6045d.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2316

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C7C029A7D7310EADDF4E52B7A3341812
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\Installer\MSIEBF9.tmp
  "C:\Windows\Installer\MSIEBF9.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\Windows\Installer\MSIEC3A.tmp
  "C:\Windows\Installer\MSIEC3A.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe
"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2880

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:12588
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:10500

C:\Windows\SysWOW64\Vnfvn.exe
C:\Windows\SysWOW64\Vnfvn.exe -auto
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:9492
- C:\Windows\SysWOW64\Vnfvn.exe
  C:\Windows\SysWOW64\Vnfvn.exe -acsi
  2⤵
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:12596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76e6ca.rbs

Filesize
420KB

MD5
fd6ffc21854389eef57b121920d7eb53

SHA1
8aac2bf77db334cd65d8d6c97367eb7ec86d0e5d

SHA256
0fd912837817a118362aa21689ee9b3a009734bccde647071e9aaed430703e9f

SHA512
9f2756c4bf8444ec5a5aa0076849cbaf082747677b5d4a53eda832c824c949b8b06429a7bd107a59e508de5406faabc386a3b7291509c43d2864197d272b9ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

Filesize
27.6MB

MD5
27efe6811144928bfa97cd230d186b27

SHA1
1fe73e16d011fcaf8846184da6a55f305f676438

SHA256
1612b03971062edc8cc50072404c5734e6d3ce28a3e32d45418fce6bf6a071aa

SHA512
93d554c4d0b1e589c9c284f3954931232f34abf4da09c57b0c4f1f50cf618406a7d652c545800b346cee40099164f3397b8e7a075c9e3ff9e110331bf4d3f7e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\OP_WndProc.dll

Filesize
48KB

MD5
765cf74fc709fb3450fa71aac44e7f53

SHA1
b423271b4faac68f88fef15fa4697cf0149bad85

SHA256
cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e

SHA512
0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\btn_agree.bmp

Filesize
38KB

MD5
dab018047c171165c18329d5c59b617e

SHA1
88848ac4aceb7358f13d225de6d4fd0a5696517a

SHA256
1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734

SHA512
1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\btn_disagree.bmp

Filesize
38KB

MD5
5f7b90c87ea0517771862fae5f11ce94

SHA1
fc9f195e888d960139278c04a0e78996c6442d5b

SHA256
f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2

SHA512
dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\checkbox_null.bmp

Filesize
3KB

MD5
5754c67775c3f4f50a4780b3bca026b1

SHA1
3e95c72c13d6175ef275280fe270d678acee46e9

SHA256
2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739

SHA512
df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\slide6.bmp

Filesize
908KB

MD5
3d3ec6392cf9a8b408569a3dd4cd3ce8

SHA1
95ff4346eb20d9239c37e6538bb8df8542d3300a

SHA256
818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371

SHA512
e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505

Download Submit
C:\Windows\Installer\MSIE782.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Windows\Installer\MSIEBF9.tmp

Filesize
419KB

MD5
cac0eaeb267d81cf3fa968ee23a6af9d

SHA1
cf6ae8e44fb4949d5f0b01b110eaba49d39270a2

SHA256
f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774

SHA512
8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

Download Submit
\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\LockedList.dll

Filesize
95KB

MD5
5a94bf8916a11b5fe94aca44886c9393

SHA1
820d9c5e3365e323d6f43d3cce26fd9d2ea48b93

SHA256
0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d

SHA512
79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

Download Submit
\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\SkinBtn.dll

Filesize
4KB

MD5
29818862640ac659ce520c9c64e63e9e

SHA1
485e1e6cc552fa4f05fb767043b1e7c9eb80be64

SHA256
e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb

SHA512
ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

Download Submit
\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsjEEF3.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
memory/2572-894-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-908-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-874-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-864-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-861-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-880-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-882-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-884-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-878-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-888-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-896-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-872-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-892-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-890-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-876-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-886-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-898-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-904-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-906-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-866-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-910-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-912-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-914-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-916-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-902-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-920-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-870-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-868-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-862-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-51-0x0000000076510000-0x0000000076557000-memory.dmp

Filesize
284KB

Download
memory/2572-47-0x0000000002610000-0x00000000041A6000-memory.dmp

Filesize
27.6MB

Download
memory/2572-43-0x0000000000400000-0x0000000001F96000-memory.dmp

Filesize
27.6MB

Download
memory/2572-46-0x0000000002610000-0x00000000041A6000-memory.dmp

Filesize
27.6MB

Download
memory/2572-900-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-918-0x0000000004270000-0x0000000004381000-memory.dmp

Filesize
1.1MB

Download
memory/2572-17545-0x0000000000400000-0x0000000001F96000-memory.dmp

Filesize
27.6MB

Download
memory/2708-36-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2772-37-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download