Analysis
-
max time kernel
157s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe
-
Size
26KB
-
MD5
43f24e3e1c813fb3984f3bac0a0a4d30
-
SHA1
83da35f3da1f515e75bf2075d59b508392e5d253
-
SHA256
6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9
-
SHA512
c666d6f4ff4b0658d9dd2c021f744f94633bd38448b9ba9f1c299143ff7842fd8972cd4a6264c852069679b05629ef11ae2be6ee14623b3f60fcdbf2dfa16b58
-
SSDEEP
768:RvLw1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:JifgLdQAQfcfymNG+Kx
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\Y: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\X: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\U: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\M: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\L: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\G: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\E: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\V: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\S: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\R: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\P: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\K: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\Z: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\T: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\I: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\F: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\W: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\Q: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\O: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\N: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened (read-only) \??\J: 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fi-fi\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5024 wrote to memory of 3556 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 85 PID 5024 wrote to memory of 3556 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 85 PID 5024 wrote to memory of 3556 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 85 PID 3556 wrote to memory of 5040 3556 net.exe 87 PID 3556 wrote to memory of 5040 3556 net.exe 87 PID 3556 wrote to memory of 5040 3556 net.exe 87 PID 5024 wrote to memory of 3048 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 41 PID 5024 wrote to memory of 3048 5024 6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe 41
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe"C:\Users\Admin\AppData\Local\Temp\6f998ebe62aa6d5bcd911e9ae13b9d8c22ab8ee561ef53b59459b4ebd3e95df9.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5040
-
-
-