Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe
-
Size
43KB
-
MD5
60434807cecbdba30b742b0001fb9f70
-
SHA1
142022be226294cce9ea84c8e90a343285554182
-
SHA256
1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49
-
SHA512
afb9c3ea5bc24a08614438dfa26171c44b9ce077dec41420043f566966c54da60bc340b1a83146d805298953f0f7a1766910f54fa94f7321982ef12425624a5e
-
SSDEEP
768:08T2ljlL5b+n8WF6z6zq8bW+g5L6wLvo4nF0fUFKPv2QT2zAm8X6sghNv:0Xj95b+n8wZq8b05LjFKPvI58/o
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\W: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\T: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\S: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\Q: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\H: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\Y: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\U: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\O: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\N: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\K: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\J: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\G: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\F: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\Z: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\V: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\P: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\M: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\I: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\R: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\L: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened (read-only) \??\E: 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\jfr\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Microsoft Games\Hearts\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Windows Mail\it-IT\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Google\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Java\jre7\bin\server\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Windows Mail\de-DE\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Google\Update\Install\{89BA9AFB-5EEA-4B19-9C5E-CEDE048A6D36}\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\VideoLAN\VLC\locale\az\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\Windows Defender\de-DE\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files (x86)\Windows Mail\it-IT\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe File created C:\Windows\Dll.dll 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1804 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 27 PID 1016 wrote to memory of 1804 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 27 PID 1016 wrote to memory of 1804 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 27 PID 1016 wrote to memory of 1804 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 27 PID 1804 wrote to memory of 1408 1804 net.exe 29 PID 1804 wrote to memory of 1408 1804 net.exe 29 PID 1804 wrote to memory of 1408 1804 net.exe 29 PID 1804 wrote to memory of 1408 1804 net.exe 29 PID 1016 wrote to memory of 1256 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 13 PID 1016 wrote to memory of 1256 1016 1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe"C:\Users\Admin\AppData\Local\Temp\1ce6cb9bf3a64bf0d140f0ba8285388301f01d8d643f491ca9571bee4b832c49.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1408
-
-
-