Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 09:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe
Resource
win7-20230831-en
windows7-x64
11 signatures
150 seconds
General
-
Target
d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe
-
Size
477KB
-
MD5
67b45eccef4ee3048edf9d6608a188eb
-
SHA1
a18590300155bd6538d97cf9cc5d9a9833d9d198
-
SHA256
d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c
-
SHA512
84f8d80050acb362a445c27b1160b239bdb14dba96b17d118d26c1740bc0f413187fcd5757218b86293f56804d9158f5bfaf8626c6aab886638ba09a00f36e78
-
SSDEEP
12288:zz+aSZc0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVzy:nBOMYenGJiKEbXWtfOkUy
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 3 IoCs
pid Process 4480 Logo1_.exe 1260 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 5100 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe -
Loads dropped DLL 1 IoCs
pid Process 5100 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe File created C:\Windows\Logo1_.exe d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe 4480 Logo1_.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4900 wrote to memory of 752 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 84 PID 4900 wrote to memory of 752 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 84 PID 4900 wrote to memory of 752 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 84 PID 752 wrote to memory of 1872 752 net.exe 87 PID 752 wrote to memory of 1872 752 net.exe 87 PID 752 wrote to memory of 1872 752 net.exe 87 PID 4900 wrote to memory of 392 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 88 PID 4900 wrote to memory of 392 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 88 PID 4900 wrote to memory of 392 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 88 PID 4900 wrote to memory of 4480 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 90 PID 4900 wrote to memory of 4480 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 90 PID 4900 wrote to memory of 4480 4900 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 90 PID 4480 wrote to memory of 4752 4480 Logo1_.exe 91 PID 4480 wrote to memory of 4752 4480 Logo1_.exe 91 PID 4480 wrote to memory of 4752 4480 Logo1_.exe 91 PID 392 wrote to memory of 1260 392 cmd.exe 92 PID 392 wrote to memory of 1260 392 cmd.exe 92 PID 392 wrote to memory of 1260 392 cmd.exe 92 PID 4752 wrote to memory of 2200 4752 net.exe 94 PID 4752 wrote to memory of 2200 4752 net.exe 94 PID 4752 wrote to memory of 2200 4752 net.exe 94 PID 1260 wrote to memory of 5100 1260 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 95 PID 1260 wrote to memory of 5100 1260 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 95 PID 1260 wrote to memory of 5100 1260 d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe 95 PID 4480 wrote to memory of 3692 4480 Logo1_.exe 96 PID 4480 wrote to memory of 3692 4480 Logo1_.exe 96 PID 4480 wrote to memory of 3692 4480 Logo1_.exe 96 PID 3692 wrote to memory of 1144 3692 net.exe 98 PID 3692 wrote to memory of 1144 3692 net.exe 98 PID 3692 wrote to memory of 1144 3692 net.exe 98 PID 4480 wrote to memory of 3148 4480 Logo1_.exe 61 PID 4480 wrote to memory of 3148 4480 Logo1_.exe 61
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe"C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE649.bat3⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe"C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe"C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe" -burn.unelevated BurnPipe.{C37A3EE1-D69E-4CBA-B168-4181B5EF5507} {FEAD2A80-F69C-4DFE-8031-8256672FB26F} 12605⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5100
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2200
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1144
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5e4121d9935f33e4f29cd063bb967e9b3
SHA10221815d3e67f8ffa06cfeaef2faac0cfc6fe6ce
SHA2561cbe20b082744c4f445d2be69135b2ffb3ee4d3a121254ccef29310e91cb5ffc
SHA51207d0ffbf9ba0b330c82d301fc195f0c3154dbd651ca71869f8cebe5f6038606a01cb16d57c28b6553cb19ff265619b1de491c58755cb5864ee99ba7b065b8af0
-
Filesize
491KB
MD5079f633ee8059f40558d558e7c252620
SHA1948b8bf5b39ac59dbef866d2355a7b0ed85dfe8e
SHA256075fc8fa58245fc801131401efb09e4a37bf60cdb5c34b746cd9f84348baccd8
SHA512150752825b047caf5e456f068104ac8fb3c51dcf30f32d1db413b02bfaccd081f9b8451b38ecb97797fb9f66f0a97b381f05532ae9101b9a2c42bd4bbe1490c8
-
Filesize
722B
MD584d040aeed9cd6c1b32d455f61ebafbf
SHA1e3ca0e0b498a0258a405a41ec7719bb9d24d49b5
SHA25667972cac429761d18badb1d6b9b8e4790b20b9e42b143c5fe830e5062a53f1cd
SHA512b78ef5351f37d9fbcd287a92ce20a159478e8252f738eba01c989841d5141e9956eb4b07435fe4c0dac89d59fd67c33d497ac7f6c9d0750ff8622f51ff351489
-
C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe
Filesize444KB
MD52b48f69517044d82e1ee675b1690c08b
SHA183ca22c8a8e9355d2b184c516e58b5400d8343e0
SHA256507bdc3ab5a6d9ddba2df68aff6f59572180134252f5eb8cb46f9bb23006b496
SHA51297d9b130a483263ddf59c35baceba999d7c8db4effc97bcb935cb57acc7c8d46d3681c95e24975a099e701997330c6c6175e834ddb16abc48d5e9827c74a325b
-
C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe
Filesize444KB
MD52b48f69517044d82e1ee675b1690c08b
SHA183ca22c8a8e9355d2b184c516e58b5400d8343e0
SHA256507bdc3ab5a6d9ddba2df68aff6f59572180134252f5eb8cb46f9bb23006b496
SHA51297d9b130a483263ddf59c35baceba999d7c8db4effc97bcb935cb57acc7c8d46d3681c95e24975a099e701997330c6c6175e834ddb16abc48d5e9827c74a325b
-
C:\Users\Admin\AppData\Local\Temp\d97065a794957cf435b3b99b7a6defd6a79d30cd2b0ea2cb122b9e216aff0b7c.exe.exe
Filesize444KB
MD52b48f69517044d82e1ee675b1690c08b
SHA183ca22c8a8e9355d2b184c516e58b5400d8343e0
SHA256507bdc3ab5a6d9ddba2df68aff6f59572180134252f5eb8cb46f9bb23006b496
SHA51297d9b130a483263ddf59c35baceba999d7c8db4effc97bcb935cb57acc7c8d46d3681c95e24975a099e701997330c6c6175e834ddb16abc48d5e9827c74a325b
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
126KB
MD5d7bf29763354eda154aad637017b5483
SHA1dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA2567f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
SHA5121c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
-
Filesize
33KB
MD541783923a9a0452ad35b6cc203d34f79
SHA1f70636b7219593416147dcaf74ccfddad3053896
SHA256c0b7fd1bc95b52a8d703f5c72e52542299a5ad91b92a292c9806a9311d96e607
SHA5122931deae0146515939b1c77c0b6c32761b757db973c482333c0a2cfc730b808004fabb3683a29fa14903c8f4ddda7517ab5518a9e18ecb1a38c8dbebcd0275c0
-
Filesize
33KB
MD541783923a9a0452ad35b6cc203d34f79
SHA1f70636b7219593416147dcaf74ccfddad3053896
SHA256c0b7fd1bc95b52a8d703f5c72e52542299a5ad91b92a292c9806a9311d96e607
SHA5122931deae0146515939b1c77c0b6c32761b757db973c482333c0a2cfc730b808004fabb3683a29fa14903c8f4ddda7517ab5518a9e18ecb1a38c8dbebcd0275c0
-
Filesize
33KB
MD541783923a9a0452ad35b6cc203d34f79
SHA1f70636b7219593416147dcaf74ccfddad3053896
SHA256c0b7fd1bc95b52a8d703f5c72e52542299a5ad91b92a292c9806a9311d96e607
SHA5122931deae0146515939b1c77c0b6c32761b757db973c482333c0a2cfc730b808004fabb3683a29fa14903c8f4ddda7517ab5518a9e18ecb1a38c8dbebcd0275c0
-
Filesize
8B
MD5587438ba3214d6958f23eced1b2cd39c
SHA156d9150b977089419b026aaf6ee032981c437dfd
SHA2564a9d4c3f321c10e2bb0319dca7695b9b3252a0e1d35cfc2a09bac15d5c36e090
SHA51231309fcfa73bf18bb138cbe3744414acc13498184290586c8f185e828027f7b0c647f3f102826099465c7995a29e8a33d95f832ffac8d16b619b53f037e4fd63
