Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
Resource
win7-20220812-en
General
-
Target
4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
-
Size
39KB
-
MD5
8a3b9e40a14334cceb40273473ea1720
-
SHA1
0c4dea469d2dcc4741f0368f7d12a9b79d7a6887
-
SHA256
4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a
-
SHA512
c7d39433ca797ec739119d736a41ffbf80d06ba91aa649d0236a105bb7980d8d0583bd76dc7793107419da0c3525dc88f6c0f142c047177dd6702ee8b05f2cd4
-
SSDEEP
768:znhO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:znhe+Zk7VJbwlYXjPrsqrZMYR5p8w
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\R: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\P: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\M: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\L: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\G: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\Z: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\X: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\S: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\Q: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\J: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\H: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\Y: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\W: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\T: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\K: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\E: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\U: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\O: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\N: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\I: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\F: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Common Files\Services\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Mozilla Firefox\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Windows\Dll.dll 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1644 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 27 PID 1672 wrote to memory of 1644 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 27 PID 1672 wrote to memory of 1644 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 27 PID 1672 wrote to memory of 1644 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 27 PID 1644 wrote to memory of 984 1644 net.exe 29 PID 1644 wrote to memory of 984 1644 net.exe 29 PID 1644 wrote to memory of 984 1644 net.exe 29 PID 1644 wrote to memory of 984 1644 net.exe 29 PID 1672 wrote to memory of 240 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 30 PID 1672 wrote to memory of 240 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 30 PID 1672 wrote to memory of 240 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 30 PID 1672 wrote to memory of 240 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 30 PID 240 wrote to memory of 1100 240 net.exe 32 PID 240 wrote to memory of 1100 240 net.exe 32 PID 240 wrote to memory of 1100 240 net.exe 32 PID 240 wrote to memory of 1100 240 net.exe 32 PID 1672 wrote to memory of 1260 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 18 PID 1672 wrote to memory of 1260 1672 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 18
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe"C:\Users\Admin\AppData\Local\Temp\4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:984
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1100
-
-
-