Malware Analysis Report

2024-12-07 14:03

Sample ID 241116-p1pvzsxanl
Target f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c.msi.vir
SHA256 f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c
Tags
gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c

Threat Level: Known bad

The file f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c.msi.vir was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan

Gh0st RAT payload

Purplefox family

Gh0strat

Detect PurpleFox Rootkit

PurpleFox

Gh0strat family

Enumerates connected drives

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Executes dropped EXE

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Event Triggered Execution: Installer Packages

System Network Configuration Discovery: Internet Connection Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Checks processor information in registry

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-16 12:48

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-16 12:47

Reported

2024-11-16 12:52

Platform

win7-20240903-en

Max time kernel

148s

Max time network

153s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c.msi

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Qiyqi.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Qiyqi.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\f76fc9a.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI67B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76fc9a.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI11A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI233.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2D0.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI541.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6CB.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76fc97.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76fc97.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSI6CB.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSI67B.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Qiyqi.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Qiyqi.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\Qiyqi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\Qiyqi.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\Qiyqi.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\Qiyqi.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\Qiyqi.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\Qiyqi.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\Qiyqi.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Qiyqi.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2608 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2680 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI67B.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 2600 wrote to memory of 2900 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6CB.tmp
PID 8656 wrote to memory of 6456 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 8656 wrote to memory of 6456 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 8656 wrote to memory of 6456 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 8656 wrote to memory of 6456 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 6328 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 6328 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C1A76EB68612543C1805B1A7E1B751AD

C:\Windows\Installer\MSI67B.tmp

"C:\Windows\Installer\MSI67B.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\Installer\MSI6CB.tmp

"C:\Windows\Installer\MSI6CB.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe

"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\SysWOW64\Qiyqi.exe

C:\Windows\SysWOW64\Qiyqi.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul

C:\Windows\SysWOW64\Qiyqi.exe

C:\Windows\SysWOW64\Qiyqi.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
HK 154.23.221.136:1796 tcp

Files

C:\Windows\Installer\MSI11A.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Config.Msi\f76fc9b.rbs

MD5 e8dea696fd913861af51d92402019376
SHA1 0fb73ec6bf2dee2c7db4663cc5ebec5205803e41
SHA256 84e9be39b0be30ae338ffe08974a8c4680d77cebb14676815b10344402869bf8
SHA512 616543545233a5a598da7245042c36795f0d46de8446bad911400f1573044728b52bbc0373f298725d76dfc4407e9d4d1c0261cab42c95e5257fe3bed12d57ef

C:\Windows\Installer\MSI67B.tmp

MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

memory/2900-37-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2680-36-0x00000000001A0000-0x00000000001A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

MD5 a49abf78c43c524063701cf1806f4a25
SHA1 12fcf9bdd4f41d5f9e10214849b4243bf2e295ab
SHA256 63a979f29374bfa7bd4a455b2dc6f98fd9f9b0ebd0716c8c3290a24302ad3dcc
SHA512 30945688e13b15b07f995d0be1544d364948ab74ca30d4919c51ec585972393582d5ddbe7c9719d70a3e0d3ce0b92a46f0e1743723d2dbba4f39bcfb5d7d9f31

memory/2512-48-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/2512-49-0x00000000025F0000-0x0000000004173000-memory.dmp

memory/2512-50-0x0000000075CB0000-0x0000000075CF7000-memory.dmp

memory/2512-860-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-863-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-866-0x00000000025F0000-0x0000000004173000-memory.dmp

memory/2512-861-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-865-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-868-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-870-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-872-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-874-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-878-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-880-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-876-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-882-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-884-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-886-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-888-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-892-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-894-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-896-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-898-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-902-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-900-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-890-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-904-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-912-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-914-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-916-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-918-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-910-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-922-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-921-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-908-0x0000000004360000-0x0000000004471000-memory.dmp

memory/2512-906-0x0000000004360000-0x0000000004471000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsyA20.tmp\SkinBtn.dll

MD5 29818862640ac659ce520c9c64e63e9e
SHA1 485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256 e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512 ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

C:\Users\Admin\AppData\Local\Temp\nsyA20.tmp\slide6.bmp

MD5 3d3ec6392cf9a8b408569a3dd4cd3ce8
SHA1 95ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256 818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512 e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505

\Users\Admin\AppData\Local\Temp\nsyA20.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

\Users\Admin\AppData\Local\Temp\nsyA20.tmp\nsDialogs.dll

MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

C:\Users\Admin\AppData\Local\Temp\nsyA20.tmp\checkbox_null.bmp

MD5 5754c67775c3f4f50a4780b3bca026b1
SHA1 3e95c72c13d6175ef275280fe270d678acee46e9
SHA256 2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512 df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

C:\Users\Admin\AppData\Local\Temp\nsyA20.tmp\btn_disagree.bmp

MD5 5f7b90c87ea0517771862fae5f11ce94
SHA1 fc9f195e888d960139278c04a0e78996c6442d5b
SHA256 f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512 dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

C:\Users\Admin\AppData\Local\Temp\nsyA20.tmp\btn_agree.bmp

MD5 dab018047c171165c18329d5c59b617e
SHA1 88848ac4aceb7358f13d225de6d4fd0a5696517a
SHA256 1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA512 1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

\Users\Admin\AppData\Local\Temp\nsyA20.tmp\LockedList.dll

MD5 5a94bf8916a11b5fe94aca44886c9393
SHA1 820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA256 0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA512 79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

\Users\Admin\AppData\Local\Temp\nsyA20.tmp\OP_WndProc.dll

MD5 765cf74fc709fb3450fa71aac44e7f53
SHA1 b423271b4faac68f88fef15fa4697cf0149bad85
SHA256 cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA512 0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

memory/2512-17546-0x0000000000400000-0x0000000001F83000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-16 12:47

Reported

2024-11-16 12:52

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

159s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c.msi

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\Qiyqi.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Qiyqi.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Qiyqi.exe C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSIB7EC.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB0D5.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB4FD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIAF3C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIAFAB.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{4B2B1826-5935-494B-B7C1-90C074EA6814} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57abb1.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIADC4.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB019.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB899.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e57abb1.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSIB7EC.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Installer\MSIB899.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Qiyqi.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Qiyqi.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\Qiyqi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\Qiyqi.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\SysWOW64\Qiyqi.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" C:\Windows\SysWOW64\Qiyqi.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\Qiyqi.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
N/A N/A C:\Windows\SysWOW64\Qiyqi.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Qiyqi.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Qiyqi.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2480 wrote to memory of 3132 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2480 wrote to memory of 3132 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2480 wrote to memory of 3132 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2480 wrote to memory of 1936 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIB7EC.tmp
PID 2480 wrote to memory of 1936 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIB7EC.tmp
PID 2480 wrote to memory of 1936 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIB7EC.tmp
PID 2480 wrote to memory of 624 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIB899.tmp
PID 2480 wrote to memory of 624 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIB899.tmp
PID 2480 wrote to memory of 624 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIB899.tmp
PID 1492 wrote to memory of 10068 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 1492 wrote to memory of 10068 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 1492 wrote to memory of 10068 N/A C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 6724 wrote to memory of 14204 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 6724 wrote to memory of 14204 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 6724 wrote to memory of 14204 N/A C:\Windows\SysWOW64\Qiyqi.exe C:\Windows\SysWOW64\Qiyqi.exe
PID 10068 wrote to memory of 14144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 10068 wrote to memory of 14144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 10068 wrote to memory of 14144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f4df6a9e22ef1760054f9bb71c0512afb28332722beee1adddfeb6145918d74c.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 4DF274C8E5DB6FA1BAB91D1EA3396BCC

C:\Windows\Installer\MSIB7EC.tmp

"C:\Windows\Installer\MSIB7EC.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\Installer\MSIB899.tmp

"C:\Windows\Installer\MSIB899.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe

"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"

C:\Windows\SysWOW64\Qiyqi.exe

C:\Windows\SysWOW64\Qiyqi.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul

C:\Windows\SysWOW64\Qiyqi.exe

C:\Windows\SysWOW64\Qiyqi.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
HK 154.23.221.136:1796 tcp
US 8.8.8.8:53 136.221.23.154.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

C:\Windows\Installer\MSIADC4.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Config.Msi\e57abb4.rbs

MD5 c36582bf58ef56d76239f6ddf61b8bd2
SHA1 d19b0c76d7b1b1c2fd42de258da78d189fb9b1e1
SHA256 18e99a8c842da505cc26b353ccba85ed39d37b4393a48c0edb832483af0da30a
SHA512 8bead5b0020a741a9388b00b39e40706e7f78099bfa31d0f1a1667408117742dbd297f2b74f670560abfd60bb21a55f906f7e55d69e22e9bf3ecafdf0daa4951

C:\Windows\Installer\MSIB7EC.tmp

MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe

MD5 a49abf78c43c524063701cf1806f4a25
SHA1 12fcf9bdd4f41d5f9e10214849b4243bf2e295ab
SHA256 63a979f29374bfa7bd4a455b2dc6f98fd9f9b0ebd0716c8c3290a24302ad3dcc
SHA512 30945688e13b15b07f995d0be1544d364948ab74ca30d4919c51ec585972393582d5ddbe7c9719d70a3e0d3ce0b92a46f0e1743723d2dbba4f39bcfb5d7d9f31

memory/1492-45-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/1492-46-0x0000000075DC0000-0x0000000075FD5000-memory.dmp

memory/1492-3925-0x00000000754E0000-0x0000000075680000-memory.dmp

memory/1492-5934-0x0000000076760000-0x00000000767DA000-memory.dmp

memory/1492-13119-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/1492-13120-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/1492-13121-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/1492-13122-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/1492-13124-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/1492-13125-0x0000000010000000-0x000000001019F000-memory.dmp

memory/1492-13133-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/6724-13136-0x0000000075DC0000-0x0000000075FD5000-memory.dmp

memory/6724-17010-0x00000000754E0000-0x0000000075680000-memory.dmp

memory/6724-19019-0x0000000076760000-0x00000000767DA000-memory.dmp

memory/6724-26204-0x0000000000400000-0x0000000001F83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\SkinBtn.dll

MD5 29818862640ac659ce520c9c64e63e9e
SHA1 485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256 e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512 ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

memory/6724-26228-0x0000000000400000-0x0000000001F83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\slide6.bmp

MD5 3d3ec6392cf9a8b408569a3dd4cd3ce8
SHA1 95ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256 818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512 e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505

memory/6724-26249-0x0000000000400000-0x0000000001F83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\nsDialogs.dll

MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\checkbox_null.bmp

MD5 5754c67775c3f4f50a4780b3bca026b1
SHA1 3e95c72c13d6175ef275280fe270d678acee46e9
SHA256 2a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512 df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

memory/6724-26257-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/6724-26235-0x0000000000400000-0x0000000001F83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\btn_disagree.bmp

MD5 5f7b90c87ea0517771862fae5f11ce94
SHA1 fc9f195e888d960139278c04a0e78996c6442d5b
SHA256 f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512 dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\OP_WndProc.dll

MD5 765cf74fc709fb3450fa71aac44e7f53
SHA1 b423271b4faac68f88fef15fa4697cf0149bad85
SHA256 cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA512 0c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6

memory/6724-26276-0x0000000000400000-0x0000000001F83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\LockedList.dll

MD5 5a94bf8916a11b5fe94aca44886c9393
SHA1 820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA256 0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA512 79cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20

C:\Users\Admin\AppData\Local\Temp\nsiC1EA.tmp\btn_agree.bmp

MD5 dab018047c171165c18329d5c59b617e
SHA1 88848ac4aceb7358f13d225de6d4fd0a5696517a
SHA256 1cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA512 1f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d

memory/6724-26314-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-26316-0x0000000075DC0000-0x0000000075FD5000-memory.dmp

memory/14204-30190-0x00000000754E0000-0x0000000075680000-memory.dmp

memory/14204-32199-0x0000000076760000-0x00000000767DA000-memory.dmp

memory/14204-39384-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-39385-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-39387-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-39386-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-39389-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-39390-0x0000000000400000-0x0000000001F83000-memory.dmp

memory/14204-39406-0x0000000000400000-0x0000000001F83000-memory.dmp