fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
Size

29KB
MD5

0c703da6086c3f27b18ded94c3173e44
SHA1

4ded32f04260e5359d04640d4ac7a2449e772bca
SHA256

fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde
SHA512

0414051bca55539e4821f1cc964bb45fa624b617e5eff8204f8a5178224405256816e4f693c1b5b62680ef17bf47f09b12d7c3c418b59653b97d8828af30dffa
SSDEEP

384:Nbbgh0OJe1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pS816GVRu1yK9fMnJG2V9dHS8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\V:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\R:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\P:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\N:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\Z:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\L:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\E:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\O:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\M:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\G:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\Y:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\X:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\U:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\T:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\Q:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\S:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\K:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\J:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\I:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened (read-only)	\??\H:	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-sl\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 208	4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe	81
PID 4108 wrote to memory of 208	4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe	81
PID 4108 wrote to memory of 208	4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe	81
PID 208 wrote to memory of 2252	208	net.exe	83
PID 208 wrote to memory of 2252	208	net.exe	83
PID 208 wrote to memory of 2252	208	net.exe	83
PID 4108 wrote to memory of 2788	4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe	54
PID 4108 wrote to memory of 2788	4108	fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2788
- C:\Users\Admin\AppData\Local\Temp\fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe
  "C:\Users\Admin\AppData\Local\Temp\fb046a393fa5157dfd9c7588cdee0a2f63a080ffa87f37c07e4108b122a64fde.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
4f6a98f6a0625a7c9089572d4ed066e0

SHA1
678514020e3072e9996e5a916093bfacba0f2034

SHA256
0cb16d3c2e08e5a2c6fcc0f1b6af2013bfdcd49aba6e6d84e5fd0cddfab2e8fa

SHA512
5a27c30deb869eab41cfd0f624c3e8db4a3332faea951927594964866146105d75debc50dc682856f82b58f6cd812e4fcbfbffaefa36dcbeaee0b0beb45ff30e

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
6151ed30ba3db5e3ab09c633cb759c66

SHA1
28d548ee727f74aa378271cd49677560dc3cff68

SHA256
753d35d472d486ac87e88f887a7c3bcca3bc23cc6468b9dc98234e5d4519a1e2

SHA512
c49acc182eb195c983f513750b69c2bd2455be072e488f5b20ca4d52272e277cb599f694b2453dee94590b77e4b8b3549165130037b8301540e7b98eef5de9b5

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1043950675-1972537973-2972532878-1000\_desktop.ini

Filesize
9B

MD5
c0232c2f01c543d260713210da47a57b

SHA1
63f2c13c2c5c83091133c2802e69993d52e3ec65

SHA256
278e1b8fd3f40d95faaecf548098b8d9ee4b32e98a8878559c8c8dfcd5cd1197

SHA512
2ccfd67393a63f03f588296bb798d7a7d4ec2ea5d6ac486cb7bdf8a5a66b1df944d8b548f317e58bfe17dea2ae54e536ffe77bc11a43c931f3d10e299ab3fca0

Download Submit
memory/4108-27-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-135-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-1264-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-4370-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4108-4806-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download