a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf

General

Target

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
Size

751KB
MD5

01556b65dee807dead61c88aa71c0efc
SHA1

629ef498b2fd362442b2b232a940860d94e38311
SHA256

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf
SHA512

0eb0d9a8543e23815efc0933fa24ad72cd410c7091cb89a7a7cbcd6f02d5b2aa699676b77afd94028dad3e83de5b77bae9e29fe212b4079316bb76ac6fb33818
SSDEEP

12288:53Nc6QXqw9MgKnxYaGu5jji2YQ6MpzUK1bOnnCOazb4gR8wmq3/PFdTyVD:53NcDKnxYaXJi2Y3MpbwnCvzb4cbmYdU

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exeLogo1_.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exea5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

pid process

748 Logo1_.exe
996 a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1524 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1524 cmd.exe
1524 cmd.exe

pid	process
748	Logo1_.exe
996	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

pid	process
1524	cmd.exe

pid	process
1524	cmd.exe
1524	cmd.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files\Java\jre7\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\PROOF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
File created	C:\Windows\Logo1_.exe	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exeLogo1_.exe

pid	process
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe
748	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

pid process

996 a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

pid process

996 a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

pid	process
996	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

pid	process
996	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 1192 wrote to memory of 1260	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	net.exe
PID 1192 wrote to memory of 1260	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	net.exe
PID 1192 wrote to memory of 1260	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	net.exe
PID 1192 wrote to memory of 1260	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	net.exe
PID 1260 wrote to memory of 828	1260	net.exe	net1.exe
PID 1260 wrote to memory of 828	1260	net.exe	net1.exe
PID 1260 wrote to memory of 828	1260	net.exe	net1.exe
PID 1260 wrote to memory of 828	1260	net.exe	net1.exe
PID 1192 wrote to memory of 1524	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	cmd.exe
PID 1192 wrote to memory of 1524	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	cmd.exe
PID 1192 wrote to memory of 1524	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	cmd.exe
PID 1192 wrote to memory of 1524	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	cmd.exe
PID 1192 wrote to memory of 748	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	Logo1_.exe
PID 1192 wrote to memory of 748	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	Logo1_.exe
PID 1192 wrote to memory of 748	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	Logo1_.exe
PID 1192 wrote to memory of 748	1192	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe	Logo1_.exe
PID 748 wrote to memory of 1516	748	Logo1_.exe	net.exe
PID 748 wrote to memory of 1516	748	Logo1_.exe	net.exe
PID 748 wrote to memory of 1516	748	Logo1_.exe	net.exe
PID 748 wrote to memory of 1516	748	Logo1_.exe	net.exe
PID 1516 wrote to memory of 1776	1516	net.exe	net1.exe
PID 1516 wrote to memory of 1776	1516	net.exe	net1.exe
PID 1516 wrote to memory of 1776	1516	net.exe	net1.exe
PID 1516 wrote to memory of 1776	1516	net.exe	net1.exe
PID 1524 wrote to memory of 996	1524	cmd.exe	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
PID 1524 wrote to memory of 996	1524	cmd.exe	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
PID 1524 wrote to memory of 996	1524	cmd.exe	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
PID 1524 wrote to memory of 996	1524	cmd.exe	a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
PID 748 wrote to memory of 916	748	Logo1_.exe	net.exe
PID 748 wrote to memory of 916	748	Logo1_.exe	net.exe
PID 748 wrote to memory of 916	748	Logo1_.exe	net.exe
PID 748 wrote to memory of 916	748	Logo1_.exe	net.exe
PID 916 wrote to memory of 1628	916	net.exe	net1.exe
PID 916 wrote to memory of 1628	916	net.exe	net1.exe
PID 916 wrote to memory of 1628	916	net.exe	net1.exe
PID 916 wrote to memory of 1628	916	net.exe	net1.exe
PID 748 wrote to memory of 1212	748	Logo1_.exe	Explorer.EXE
PID 748 wrote to memory of 1212	748	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
"C:\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF8F0.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe
"C:\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe"
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:996

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:1776

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$aF8F0.bat

Filesize
722B

MD5
ba2b3cbf7a6ce66d6a72a528a0f4fc24

SHA1
ada250caaa18a01e01f7fd60ef9a659ba6ea2948

SHA256
5acb101f6ea3124f58679c7ba6fceb6ad6107cedc5820cb99a20a995b405ea79

SHA512
8844e4a7aba10583f8b2e177aad91a312d7aeefdf90903f9a77c260a8b56c57916209ddca826bf3c0ec5af2c0d9385c31fab27c0f4ca4008de5b9129a0aa7042

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

Filesize
717KB

MD5
169c293ce9460a05646d17dc6aa2fb2c

SHA1
f0c018d61e844447dcc5a5734e1edff4997e59d5

SHA256
a7acecc562ee9c9ffbfba51bb5963a2e0c1a8fa9a5b6a8309988a5bcd48e70e6

SHA512
7c2e9ff8e3cce6873acc54276ede5db07d4936628e49199c2d1a308d912774370ffea17bbb3f1582c5f713328a17251064c58486e3434cb92b7498d46dbd901f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe.exe

Filesize
717KB

MD5
169c293ce9460a05646d17dc6aa2fb2c

SHA1
f0c018d61e844447dcc5a5734e1edff4997e59d5

SHA256
a7acecc562ee9c9ffbfba51bb5963a2e0c1a8fa9a5b6a8309988a5bcd48e70e6

SHA512
7c2e9ff8e3cce6873acc54276ede5db07d4936628e49199c2d1a308d912774370ffea17bbb3f1582c5f713328a17251064c58486e3434cb92b7498d46dbd901f

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
3dd88b0ec0db473ba1ec88395d38b18f

SHA1
bbd8c3e6cc7eee419524004629d575ddc97c7e7a

SHA256
9ed6b0fbb8f973e5d17d716c844dd1a586829dc1b29d70ee1f56a6826fd00a0f

SHA512
ac44fb89011ee1129be139e0646c8a85e356e71f510320817b2926cd63fcbe0dd23c2384ce63edd7de75750bb5bff82f9ea3eb63bcd808bf495f2e3d8f204939

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
3dd88b0ec0db473ba1ec88395d38b18f

SHA1
bbd8c3e6cc7eee419524004629d575ddc97c7e7a

SHA256
9ed6b0fbb8f973e5d17d716c844dd1a586829dc1b29d70ee1f56a6826fd00a0f

SHA512
ac44fb89011ee1129be139e0646c8a85e356e71f510320817b2926cd63fcbe0dd23c2384ce63edd7de75750bb5bff82f9ea3eb63bcd808bf495f2e3d8f204939

Download Submit
C:\Windows\rundl132.exe

Filesize
33KB

MD5
3dd88b0ec0db473ba1ec88395d38b18f

SHA1
bbd8c3e6cc7eee419524004629d575ddc97c7e7a

SHA256
9ed6b0fbb8f973e5d17d716c844dd1a586829dc1b29d70ee1f56a6826fd00a0f

SHA512
ac44fb89011ee1129be139e0646c8a85e356e71f510320817b2926cd63fcbe0dd23c2384ce63edd7de75750bb5bff82f9ea3eb63bcd808bf495f2e3d8f204939

Download Submit
\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

Filesize
717KB

MD5
169c293ce9460a05646d17dc6aa2fb2c

SHA1
f0c018d61e844447dcc5a5734e1edff4997e59d5

SHA256
a7acecc562ee9c9ffbfba51bb5963a2e0c1a8fa9a5b6a8309988a5bcd48e70e6

SHA512
7c2e9ff8e3cce6873acc54276ede5db07d4936628e49199c2d1a308d912774370ffea17bbb3f1582c5f713328a17251064c58486e3434cb92b7498d46dbd901f

Download Submit
\Users\Admin\AppData\Local\Temp\a5453e8bdfb74c89ae3df7d85fffb21367d09b398a5474af0d44d47ae7f8c2cf.exe

Filesize
717KB

MD5
169c293ce9460a05646d17dc6aa2fb2c

SHA1
f0c018d61e844447dcc5a5734e1edff4997e59d5

SHA256
a7acecc562ee9c9ffbfba51bb5963a2e0c1a8fa9a5b6a8309988a5bcd48e70e6

SHA512
7c2e9ff8e3cce6873acc54276ede5db07d4936628e49199c2d1a308d912774370ffea17bbb3f1582c5f713328a17251064c58486e3434cb92b7498d46dbd901f

Download Submit
memory/748-70-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/748-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/748-58-0x0000000000000000-mapping.dmp

Download
memory/828-55-0x0000000000000000-mapping.dmp

Download
memory/916-75-0x0000000000000000-mapping.dmp

Download
memory/996-68-0x0000000000000000-mapping.dmp

Download
memory/996-71-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1192-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1192-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-54-0x0000000000000000-mapping.dmp

Download
memory/1516-62-0x0000000000000000-mapping.dmp

Download
memory/1524-57-0x0000000000000000-mapping.dmp

Download
memory/1628-76-0x0000000000000000-mapping.dmp

Download
memory/1776-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads