251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2023, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
Size

26KB
MD5

fd67facdbcb3418d53b336fa29a4ebaf
SHA1

bf4130709c66654c783c758f4963bfef4a13c6e6
SHA256

251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c
SHA512

90f633eb47eb22f28715bf5bf5afd71b2f7a344765f46d7eb43f3b0a8ade8aa825342f02fd8236e82280e998314f93074bde1c7b2f6ee50880afbf8b5656a189
SSDEEP

768:YK1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1:VfgLdQAQfhJIJ0IO61

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\W:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\T:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\R:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\L:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\U:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\J:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\H:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\G:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\E:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\Z:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\S:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\Q:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\P:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\K:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\Y:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\V:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\O:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\N:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\M:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened (read-only)	\??\I:	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.177.11\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\Mozilla Firefox\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-PT\View3d\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\_desktop.ini	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4664	1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe	85
PID 1708 wrote to memory of 4664	1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe	85
PID 1708 wrote to memory of 4664	1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe	85
PID 4664 wrote to memory of 180	4664	net.exe	87
PID 4664 wrote to memory of 180	4664	net.exe	87
PID 4664 wrote to memory of 180	4664	net.exe	87
PID 1708 wrote to memory of 3180	1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe	60
PID 1708 wrote to memory of 3180	1708	251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe	60

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3180
- C:\Users\Admin\AppData\Local\Temp\251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\251705bff81065dd9542bb01b938b1ea76b846ebbdad1255880cc7f416e89e7c.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
fb0e55bd598718eeb4a10556052bcc0e

SHA1
7973070c0cfc65997f07519c93cbbec18093edfe

SHA256
636ac1d870c072f456e9452f3286fc44986e28f22def36784c555b51dc6c4527

SHA512
3304b991f3f2d058cae86f99c4cd093f2d50f5153f24e34bfb9636ca964cf6ef11cf0abdd3365d63afb36413394f9fa06f34a839e9c33d962d5c9e90b3c40a85

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
ea1c37fc590737ef8532671f228c0b64

SHA1
dbe498694e3d9b13f42afd063161a997f658f2b0

SHA256
8ea6d1afaaf15a04801d56b5068ffc2f3f390c0d648ae319112ee7c795d5c08e

SHA512
0ed8b710493ee7af1fd5e98f9edac82c89484947d180f7bb86f52afa904a394b48b4f16758dc2a7c5472f9df4fb5d04d9b40bc5af15a441af3c4c9d3bf1804d7

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-919254492-3979293997-764407192-1000\_desktop.ini

Filesize
9B

MD5
2c0dac5a0ee90681d41a5cbf86d94297

SHA1
b307129f31736ea24c948dca5581aef59a81d7e4

SHA256
66a0286083e73a4fc72c934ced498268654207bc94b597c7c6c7f5df5dd03877

SHA512
cde36e6bd833ec09b79438b98ed8c5424c12c06d7e6afdbedf7b3e97786c57cf51bf6458b958fa9ef820b884b17daad45be0901b5a16fdc276489b7ffdc67e80

Download Submit
memory/1708-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-1264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-4775-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-4806-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download