Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe
-
Size
33KB
-
MD5
ad497e47848f62a27a1051e5bbe43789
-
SHA1
0ddea8e45a900b14557ebbe9569bf7ec574f4374
-
SHA256
5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37
-
SHA512
09eba4fb3e1129546cb90e4d012210f03ddb45993ce05e17241af7eeac7051cfd73ef8d38ec1c3682f9b244481ef6921c6d89b128a7dc41d3fceaa8f160f1936
-
SSDEEP
768:/nO5RroZJ76739sBWsNscWlM3dN9N3ZjfPP:/ne+Zk78NR3dN5nP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\L: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\J: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\S: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\O: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\V: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\T: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\K: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\I: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\H: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\F: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\Y: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\W: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\G: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\P: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\N: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\U: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\R: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\Q: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\E: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\Z: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened (read-only) \??\X: 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jre7\bin\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files (x86)\Google\Update\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Microsoft Games\Mahjong\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Google\CrashReports\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe File created C:\Windows\Dll.dll 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1252 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 27 PID 1760 wrote to memory of 1252 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 27 PID 1760 wrote to memory of 1252 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 27 PID 1760 wrote to memory of 1252 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 27 PID 1252 wrote to memory of 1144 1252 net.exe 29 PID 1252 wrote to memory of 1144 1252 net.exe 29 PID 1252 wrote to memory of 1144 1252 net.exe 29 PID 1252 wrote to memory of 1144 1252 net.exe 29 PID 1760 wrote to memory of 1064 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 30 PID 1760 wrote to memory of 1064 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 30 PID 1760 wrote to memory of 1064 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 30 PID 1760 wrote to memory of 1064 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 30 PID 1064 wrote to memory of 1148 1064 net.exe 32 PID 1064 wrote to memory of 1148 1064 net.exe 32 PID 1064 wrote to memory of 1148 1064 net.exe 32 PID 1064 wrote to memory of 1148 1064 net.exe 32 PID 1760 wrote to memory of 1204 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 14 PID 1760 wrote to memory of 1204 1760 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe"C:\Users\Admin\AppData\Local\Temp\5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1144
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1148
-
-
-