gh0strat | c17c018f5df7a413dc053a325b6c291c9cd84f1b9e2415ffe205e02a7e5d6b4a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpsupdate.msi
Size

28.2MB
MD5

ef294458016f546c5eebd07d2dd98bad
SHA1

66bb14f670055272e12899d401b8668cad15fac9
SHA256

c17c018f5df7a413dc053a325b6c291c9cd84f1b9e2415ffe205e02a7e5d6b4a
SHA512

97ee150f49bb587147f30d2215174f5376420abd5d659a2c68d58bc67f823715030cc328eab7e11623f4ee8504f1f080ceb44ac2d6fca7c636ea8d7c936f0333
SSDEEP

786432:r3pUIX4j1lP1FYKJGIC6rO9HN47EbHxjprMfy6s0A:zpUIIj1l9FxJGIzcteEt2e0A

Score

10^/10

gh0strat purplefox bootkit discovery execution persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/1012-110-0x000000002BB60000-0x000000002BD1D000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1012-110-0x000000002BB60000-0x000000002BD1D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1788 powershell.exe

pid	process
1788	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

wpsupdate.exe

description ioc process

File opened for modification \??\PhysicalDrive0 wpsupdate.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	wpsupdate.exe

Drops file in System32 directory 1 IoCs

Processes:

nKecPJAaIeFB.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nKecPJAaIeFB.exe.log	nKecPJAaIeFB.exe

Drops file in Program Files directory 23 IoCs

Processes:

QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exeMsiExec.exemsiexec.exeQxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exenKecPJAaIeFB.exenKecPJAaIeFB.exenKecPJAaIeFB.exeWSEcydALszNI.exe

description	ioc	process
File created	C:\Program Files\TransformOptimisticContributor\WSEcydALszNI	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File created	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe	MsiExec.exe
File created	C:\Program Files\TransformOptimisticContributor\YRtKSPCVXxSCmPuaAzactTPSddUXyw	msiexec.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\WhlKFlLXxHUitNNcNwtpUJDzrKytNL	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File created	C:\Program Files\TransformOptimisticContributor\pvugBgEMyjnfIRZnnRolAMMekSRFAr	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\pvugBgEMyjnfIRZnnRolAMMekSRFAr	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log	nKecPJAaIeFB.exe
File created	C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe	msiexec.exe
File created	C:\Program Files\TransformOptimisticContributor\WhlKFlLXxHUitNNcNwtpUJDzrKytNL	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File created	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.xml	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log	nKecPJAaIeFB.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log	nKecPJAaIeFB.exe
File created	C:\Program Files\TransformOptimisticContributor\wpsupdate.exe	msiexec.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\WSEcydALszNI	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File created	C:\Program Files\TransformOptimisticContributor\2_WSEcydALszNI.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File created	C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.vbs	WSEcydALszNI.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor	WSEcydALszNI.exe
File created	C:\Program Files\TransformOptimisticContributor\VC_redist.x64.exe	msiexec.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.xml	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File opened for modification	C:\Program Files\TransformOptimisticContributor\2_WSEcydALszNI.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
File created	C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe	MsiExec.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIC68C.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c536.msi	msiexec.exe
File created	C:\Windows\Installer\e57c534.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c534.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5E7ABEF0-9D09-49C1-952F-E73FA3349D07}	msiexec.exe

Executes dropped EXE 9 IoCs

Processes:

QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exeQxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exeWSEcydALszNI.exewpsupdate.exenKecPJAaIeFB.exenKecPJAaIeFB.exenKecPJAaIeFB.exeWSEcydALszNI.exeWSEcydALszNI.exe

pid	process
3840	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
2808	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
3400	WSEcydALszNI.exe
4840	wpsupdate.exe
3276	nKecPJAaIeFB.exe
4896	nKecPJAaIeFB.exe
2372	nKecPJAaIeFB.exe
3204	WSEcydALszNI.exe
1012	WSEcydALszNI.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

1208 msiexec.exe

pid	process
1208	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exewpsupdate.exeWSEcydALszNI.exeWSEcydALszNI.exeWSEcydALszNI.exeQxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSEcydALszNI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSEcydALszNI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSEcydALszNI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

4232 cmd.exe
2964 PING.EXE

pid	process
4232	cmd.exe
2964	PING.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001a73a27760024bf60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001a73a2770000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001a73a277000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1a73a277000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001a73a27700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exewpsupdate.exeWScript.exeMsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo\InfoLastHardInfo	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHDt = "19"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD3Verify_C = 32003000320034002d00310031002d00310039007c00570044004300200032002e0035002b00320033003200310033003800380030003400310036003500200020002000200020002000200020007c00430036002d00370030002d00390030002d00440044002d00310035002d00390039000000	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo\InfoCurHardInfo = "29a56b8a14940c3acb7a4a6443907c56\|55963946ec73b9e1d4c0264c2c6a0401"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD3_C = "e1c88404c6b9f73bfc8d61a168abb5a4"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo\InfoHDModifiedType = "hdidRecalByOldHdidFromRegIsEmpty\|2024-11-19"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD = "e1c88404c6b9f73bfc8d61a168abb5a4"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD3t = "19"	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 22 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\Version = "100859912"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList\PackageName = "wpsupdate.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ED4346F32F1F8CA46B2D014BA47DCC9B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FEBA7E590D91C9459F27EF33A43D970	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\ProductName = "TransformOptimisticContributor"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FEBA7E590D91C9459F27EF33A43D970\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\PackageCode = "CCD296EAB4068834AB0FC3DB62EF5779"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FEBA7E590D91C9459F27EF33A43D970\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ED4346F32F1F8CA46B2D014BA47DCC9B\0FEBA7E590D91C9459F27EF33A43D970	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2964 PING.EXE

pid	process
2964	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exepowershell.exewpsupdate.exeWSEcydALszNI.exe

pid	process
716	msiexec.exe
716	msiexec.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe
3400	WSEcydALszNI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exepowershell.exeQxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exeQxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe

description	pid	process
Token: SeShutdownPrivilege	1208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1208	msiexec.exe
Token: SeSecurityPrivilege	716	msiexec.exe
Token: SeCreateTokenPrivilege	1208	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1208	msiexec.exe
Token: SeLockMemoryPrivilege	1208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1208	msiexec.exe
Token: SeMachineAccountPrivilege	1208	msiexec.exe
Token: SeTcbPrivilege	1208	msiexec.exe
Token: SeSecurityPrivilege	1208	msiexec.exe
Token: SeTakeOwnershipPrivilege	1208	msiexec.exe
Token: SeLoadDriverPrivilege	1208	msiexec.exe
Token: SeSystemProfilePrivilege	1208	msiexec.exe
Token: SeSystemtimePrivilege	1208	msiexec.exe
Token: SeProfSingleProcessPrivilege	1208	msiexec.exe
Token: SeIncBasePriorityPrivilege	1208	msiexec.exe
Token: SeCreatePagefilePrivilege	1208	msiexec.exe
Token: SeCreatePermanentPrivilege	1208	msiexec.exe
Token: SeBackupPrivilege	1208	msiexec.exe
Token: SeRestorePrivilege	1208	msiexec.exe
Token: SeShutdownPrivilege	1208	msiexec.exe
Token: SeDebugPrivilege	1208	msiexec.exe
Token: SeAuditPrivilege	1208	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1208	msiexec.exe
Token: SeChangeNotifyPrivilege	1208	msiexec.exe
Token: SeRemoteShutdownPrivilege	1208	msiexec.exe
Token: SeUndockPrivilege	1208	msiexec.exe
Token: SeSyncAgentPrivilege	1208	msiexec.exe
Token: SeEnableDelegationPrivilege	1208	msiexec.exe
Token: SeManageVolumePrivilege	1208	msiexec.exe
Token: SeImpersonatePrivilege	1208	msiexec.exe
Token: SeCreateGlobalPrivilege	1208	msiexec.exe
Token: SeBackupPrivilege	2076	vssvc.exe
Token: SeRestorePrivilege	2076	vssvc.exe
Token: SeAuditPrivilege	2076	vssvc.exe
Token: SeBackupPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeRestorePrivilege	3840	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: 35	3840	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: SeSecurityPrivilege	3840	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: SeSecurityPrivilege	3840	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: SeRestorePrivilege	2808	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: 35	2808	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: SeSecurityPrivilege	2808	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: SeSecurityPrivilege	2808	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe
Token: SeRestorePrivilege	716	msiexec.exe
Token: SeTakeOwnershipPrivilege	716	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msiexec.exewpsupdate.exe

pid process

1208 msiexec.exe
1208 msiexec.exe
4840 wpsupdate.exe
4840 wpsupdate.exe
4840 wpsupdate.exe
4840 wpsupdate.exe
4840 wpsupdate.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

wpsupdate.exe

pid process

4840 wpsupdate.exe
4840 wpsupdate.exe
4840 wpsupdate.exe
4840 wpsupdate.exe
4840 wpsupdate.exe

pid	process
1208	msiexec.exe
1208	msiexec.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe

pid	process
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe
4840	wpsupdate.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

msiexec.exeMsiExec.execmd.exenKecPJAaIeFB.exeWSEcydALszNI.exe

description	pid	process	target process
PID 716 wrote to memory of 3600	716	msiexec.exe	srtasks.exe
PID 716 wrote to memory of 3600	716	msiexec.exe	srtasks.exe
PID 716 wrote to memory of 2580	716	msiexec.exe	MsiExec.exe
PID 716 wrote to memory of 2580	716	msiexec.exe	MsiExec.exe
PID 2580 wrote to memory of 1788	2580	MsiExec.exe	powershell.exe
PID 2580 wrote to memory of 1788	2580	MsiExec.exe	powershell.exe
PID 2580 wrote to memory of 4232	2580	MsiExec.exe	cmd.exe
PID 2580 wrote to memory of 4232	2580	MsiExec.exe	cmd.exe
PID 4232 wrote to memory of 3840	4232	cmd.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
PID 4232 wrote to memory of 3840	4232	cmd.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
PID 4232 wrote to memory of 3840	4232	cmd.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
PID 4232 wrote to memory of 2964	4232	cmd.exe	PING.EXE
PID 4232 wrote to memory of 2964	4232	cmd.exe	PING.EXE
PID 4232 wrote to memory of 2808	4232	cmd.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
PID 4232 wrote to memory of 2808	4232	cmd.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
PID 4232 wrote to memory of 2808	4232	cmd.exe	QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
PID 2580 wrote to memory of 3400	2580	MsiExec.exe	WSEcydALszNI.exe
PID 2580 wrote to memory of 3400	2580	MsiExec.exe	WSEcydALszNI.exe
PID 2580 wrote to memory of 3400	2580	MsiExec.exe	WSEcydALszNI.exe
PID 2580 wrote to memory of 4840	2580	MsiExec.exe	wpsupdate.exe
PID 2580 wrote to memory of 4840	2580	MsiExec.exe	wpsupdate.exe
PID 2580 wrote to memory of 4840	2580	MsiExec.exe	wpsupdate.exe
PID 2372 wrote to memory of 3204	2372	nKecPJAaIeFB.exe	WSEcydALszNI.exe
PID 2372 wrote to memory of 3204	2372	nKecPJAaIeFB.exe	WSEcydALszNI.exe
PID 2372 wrote to memory of 3204	2372	nKecPJAaIeFB.exe	WSEcydALszNI.exe
PID 3204 wrote to memory of 1012	3204	WSEcydALszNI.exe	WSEcydALszNI.exe
PID 3204 wrote to memory of 1012	3204	WSEcydALszNI.exe	WSEcydALszNI.exe
PID 3204 wrote to memory of 1012	3204	WSEcydALszNI.exe	WSEcydALszNI.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wpsupdate.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1208

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 19DCCF2A218FDB0F52612F3CC81E7863 E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\TransformOptimisticContributor','C:\Program Files','C:\Program Files'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe" x "C:\Program Files\TransformOptimisticContributor\YRtKSPCVXxSCmPuaAzactTPSddUXyw" -o"C:\Program Files\TransformOptimisticContributor\" -p"03621GQD}PR[O^Dmi;;h" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe" x "C:\Program Files\TransformOptimisticContributor\WhlKFlLXxHUitNNcNwtpUJDzrKytNL" -x!1_WSEcydALszNI.exe -x!sss -x!1_OzasXnwPtTbfCAAsrowrLIIDEPUHpa.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\TransformOptimisticContributor\" -p"93629#*_tvw?-L5@gQl=" -y
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
      "C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe" x "C:\Program Files\TransformOptimisticContributor\YRtKSPCVXxSCmPuaAzactTPSddUXyw" -o"C:\Program Files\TransformOptimisticContributor\" -p"03621GQD}PR[O^Dmi;;h" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3840
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2964
  - - C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe
      "C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe" x "C:\Program Files\TransformOptimisticContributor\WhlKFlLXxHUitNNcNwtpUJDzrKytNL" -x!1_WSEcydALszNI.exe -x!sss -x!1_OzasXnwPtTbfCAAsrowrLIIDEPUHpa.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\TransformOptimisticContributor\" -p"93629#*_tvw?-L5@gQl=" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe
    "C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe" -number 177 -file file3 -mode mode3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3400
- - C:\Program Files\TransformOptimisticContributor\wpsupdate.exe
    "C:\Program Files\TransformOptimisticContributor\wpsupdate.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.vbs"
1⤵
- Modifies data under HKEY_USERS
PID:2628

C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe
"C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe" install
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
PID:3276

C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe
"C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4896

C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe
"C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe
  "C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe" -number 151 -file file3 -mode mode3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe
    "C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.exe" -number 62 -file file3 -mode mode3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c535.rbs

Filesize
8KB

MD5
c7e1ebe7390d2e66b50a83e64810d58a

SHA1
b4d89256f560a43b404178cb144389bb91eb9d53

SHA256
edb11ce6d0b03289a4624112c393f91674af7cb8b3e0ac40ce5a7be5a7aa4dc6

SHA512
3650053a3e66f4e9d2d5079c38cbe596c8f951d8b06ff0357de279b2a709a816dabe75348424ac3ee20e457e24d5e57aa715abb0e7eb4e4dfa6f9ad8bc779cea

Download Submit
C:\Program Files\TransformOptimisticContributor\2_WSEcydALszNI.exe

Filesize
2.1MB

MD5
fb22fb79f366c65257b7adb24c70d843

SHA1
ca6d29a4806d52350e1a50c7b71526dfaab2d525

SHA256
44f2ea5b5dd47fc256a341dee1d2dacfc24adba395a49fd8c4ad3613bfe2d43d

SHA512
c4dfb9273bd937f5480646e12d77073a476719f1f15ee5885e0999f0bbc68f80b1909489f7bd78a3bfb4687a55442f655f4538fda20afe4a7b87623e9bdfe7d9

Download Submit
C:\Program Files\TransformOptimisticContributor\QxbnJjybITIHnXwFgsfiCRpWIdJkGQ.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Program Files\TransformOptimisticContributor\WSEcydALszNI.vbs

Filesize
2KB

MD5
c5053a9c469416b52ac1ef0f3c4b6f3a

SHA1
1b2a53afcb6b22db953ad16116642a5e603d59c6

SHA256
7c54fccfbce7fef4dcd82fedd5811f43b553fca88811ace4e37d0837923830e5

SHA512
b9df8e58a1eabff54635a776a1c80c3c42643e3ad3ca3245eb0428b3e779ab903fcd2260d529c5fa34bb0f6b9dc62002cf1c0ba9e0d439b6905b12c837359ffa

Download Submit
C:\Program Files\TransformOptimisticContributor\WhlKFlLXxHUitNNcNwtpUJDzrKytNL

Filesize
1.5MB

MD5
d045828473a8165effd59a97232e6107

SHA1
f86bd9763d6c70ec3ca79134598de4fa44c6bc94

SHA256
9aaae0f7b3bdab287ad703c7eb4baa1a0746b6d353e57ae74d985b10a2102016

SHA512
07e77aa6a433d4541d80276d37e682012509b480a6861f9fbe3cd89929b352d6754cc649526f95c4bd76cf4e1c8bceb275a0217c38193ab88891166934d79659

Download Submit
C:\Program Files\TransformOptimisticContributor\YRtKSPCVXxSCmPuaAzactTPSddUXyw

Filesize
1.5MB

MD5
831ff4029b30419da4ac4d32bf8ff05c

SHA1
8c121d0cd017ce5f7ca8cbf6abd8909b2fe445bc

SHA256
ab281716242897be222c1d4cc979fd5de9e7d1cde56e70ac1010e6b3dc76826d

SHA512
17f2efdb891dcf9ceacb8b24801ec59866f969baa55d1c92c15a7150c13f18cc3f481984b5971456e1ad0f204db016698bfe012c086ffa2028582c1d9302a8c5

Download Submit
C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log

Filesize
290B

MD5
9f41a0f5706cb8f9dd5d020cb21f4eb0

SHA1
b1a7953a58902f4da009ea36adb95a789d0f2301

SHA256
4029dba7fdd57aeeccf3927bc7e8b3c9c7f7db0f9786f72d3903f42eb81d3bcf

SHA512
2705f09ec6e8b38500933bad6f42a72e02efe36011c3b066795edab2c978fbd76e95b1074fa466c5b9c25c53b682450a93bb2faeb4f0952bbaba5f868da671c7

Download Submit
C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log

Filesize
458B

MD5
17857fb897c8697bde9859d4c40d7999

SHA1
7a375c34af7a8c3fdd925294860e888aded60961

SHA256
fc13425778d61df7cf32d76662651d0c5aee534dd099f1c1c0a175d705e21b5d

SHA512
c874eca2435e7e56b593ce071304b1766c829a1b626f03474e79f4e7f0e8d89b93e3dd55d7f251fd91c6bc0142cf073b619bb030e56d4a40d2ada4f64c6c14bf

Download Submit
C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log

Filesize
522B

MD5
c4f8f8d71ba256f312aa991b91b6d584

SHA1
958fe95a729cad4a62972639d6a9ea38170fad1a

SHA256
5cefa51c97d25b3cf0773dbe57280760f2f5c50e5a8f65eb81fd87b818436e14

SHA512
8db01ea0832d408875683462f466705786af407a1e6ae628a15a37dbdbd858a196e116c515c2bc33329c407dd314dcc731a802e22b9f743b647d5b1acc3e6bf7

Download Submit
C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.wrapper.log

Filesize
636B

MD5
bf9b5faf7dbb1b48767088202a970d58

SHA1
4aef7d9d9a41959733803868be8b38f07bcff49c

SHA256
1bf45045df02990b5fac5b9edcfa4f1724c473acc4b45094b77ef4fa2002cf2a

SHA512
64f061272ff3ab5c8117dde190a9729e08e853a43be984c7840cdd78c2864dd5cc57f5a22f72501e4ea4a6d87050e6bc7dd860799cc9d956ee6882592e1d16ba

Download Submit
C:\Program Files\TransformOptimisticContributor\nKecPJAaIeFB.xml

Filesize
450B

MD5
423a8dfeda50218b0d1f99440f1f19bb

SHA1
5979983be9657f79aa8523018779fef0ff004282

SHA256
c88617337e75ec9a2a8c9b5a589957f2df36dd28c9d5aeb5c1453e71b6fb3c02

SHA512
19f4764a3d46de34eb707e1f50685282bfd49d766d1cd8482dae6bd09ed382021dd09e5e9f506e4b2c402c89a29c5fad78ff68d29fda8ba33310c81b74467ab9

Download Submit
C:\Program Files\TransformOptimisticContributor\wpsupdate.exe

Filesize
6.0MB

MD5
57dadd6a929f64c2b1efe2d52c1c4985

SHA1
962cb227f81f885f23826c3e040aa9dbc97659cf

SHA256
996b5d59cce7955b4374bd00d83c422d3a1d9ffebba59c66074c37ab28cfaeb5

SHA512
3f64c35e72698ea6a7e708a4367277f3ab62c27f0652e0c55bab6e02239ee37c4f0a21503c0688301fb77bbf8e59e3c5c8aa2df8d62a4ab8a9b9cdf6f0a775cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tz2uhmuv.pcu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2024_11_19.log

Filesize
2KB

MD5
322e3d0221747822554fd768a5230ed9

SHA1
127fce47b068c04e44ee90040f9e3c4ce660d4f9

SHA256
4fccfa2d971437db8eae2d7706f56ac24c64f5d066595004fdabf751ff442683

SHA512
30f512af0412a454332a19d0cb452ee20382ee653116f86a58549f9e0c56536bae3cda1ab2cfbbedb1e245dd705f81d001e103d5a0773c53f23c0b20cd4d8b52

Download Submit
C:\Windows\Installer\e57c534.msi

Filesize
28.2MB

MD5
ef294458016f546c5eebd07d2dd98bad

SHA1
66bb14f670055272e12899d401b8668cad15fac9

SHA256
c17c018f5df7a413dc053a325b6c291c9cd84f1b9e2415ffe205e02a7e5d6b4a

SHA512
97ee150f49bb587147f30d2215174f5376420abd5d659a2c68d58bc67f823715030cc328eab7e11623f4ee8504f1f080ceb44ac2d6fca7c636ea8d7c936f0333

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nKecPJAaIeFB.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
7016a78c3f2c8d79790a0b85a2bf6735

SHA1
9f81373df94b4fd8dc517cd87853bff8ec0b88c2

SHA256
2b18d5f2c13af9bb984eb8672facfed4f8400a98b278c40aaef7b32b157ab5bb

SHA512
0cf232782263dc1f9b942f83a4b553cae72ae8bfbaf04b955d8c31daa5f3ec4bfb9c37a3c9224c304aa1b0f50c3e44d8cd28c58701e588df2dbb752fa0ceeb8d

Download Submit
\??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{add72fab-36a5-4af6-b688-aed4c2a3c599}_OnDiskSnapshotProp

Filesize
6KB

MD5
913af514371d9139d3555bf6f30e00bf

SHA1
2cf7498a389405061ee1ab18768066bfa8bfc5ec

SHA256
05c660ba34fa559fc78c5320a4cbfd64035a3687bf7fb374f12248f5674225f3

SHA512
896b5d37159a08d0b4f8b0a7f8e38a0f82f4bda4dfde9c06b44f57544b2acbf9c2b974b283da24f92a9fee5eefcecc8eb621681a3cd994c3959a80c466111007

Download Submit
memory/1012-109-0x0000000029F50000-0x0000000029F9D000-memory.dmp

Filesize
308KB

Download
memory/1012-110-0x000000002BB60000-0x000000002BD1D000-memory.dmp

Filesize
1.7MB

Download
memory/1788-22-0x0000029231DB0000-0x0000029231DD2000-memory.dmp

Filesize
136KB

Download
memory/3276-76-0x0000000000B90000-0x0000000000C66000-memory.dmp

Filesize
856KB

Download
memory/3400-70-0x000000002A5A0000-0x000000002A5CF000-memory.dmp

Filesize
188KB

Download