Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2023, 05:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe
Resource
win7-20230831-en
windows7-x64
10 signatures
150 seconds
General
-
Target
426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe
-
Size
2.8MB
-
MD5
256dd5ebd731d0776f4e5cd0dfd61faa
-
SHA1
3305d0c8749e172c56f8823ca8aff5359484d96c
-
SHA256
426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018
-
SHA512
c9113cee8f6c92a7ddd63e766d0ada9239327a6d635442259174845d5fcf8f0feee6312fe715917c8ca11f14c20e3a1f22d2264f9a14c55d6937abf34a1c2123
-
SSDEEP
49152:3C6gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:3Hd1XdhBiiMa7
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3052 Logo1_.exe 4156 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe File created C:\Windows\Logo1_.exe 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe 3052 Logo1_.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4428 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 85 PID 2516 wrote to memory of 4428 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 85 PID 2516 wrote to memory of 4428 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 85 PID 4428 wrote to memory of 2432 4428 net.exe 88 PID 4428 wrote to memory of 2432 4428 net.exe 88 PID 4428 wrote to memory of 2432 4428 net.exe 88 PID 2516 wrote to memory of 5044 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 89 PID 2516 wrote to memory of 5044 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 89 PID 2516 wrote to memory of 5044 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 89 PID 2516 wrote to memory of 3052 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 91 PID 2516 wrote to memory of 3052 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 91 PID 2516 wrote to memory of 3052 2516 426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe 91 PID 3052 wrote to memory of 1228 3052 Logo1_.exe 92 PID 3052 wrote to memory of 1228 3052 Logo1_.exe 92 PID 3052 wrote to memory of 1228 3052 Logo1_.exe 92 PID 1228 wrote to memory of 5008 1228 net.exe 94 PID 1228 wrote to memory of 5008 1228 net.exe 94 PID 1228 wrote to memory of 5008 1228 net.exe 94 PID 3052 wrote to memory of 3920 3052 Logo1_.exe 99 PID 3052 wrote to memory of 3920 3052 Logo1_.exe 99 PID 3052 wrote to memory of 3920 3052 Logo1_.exe 99 PID 3920 wrote to memory of 4292 3920 net.exe 101 PID 3920 wrote to memory of 4292 3920 net.exe 101 PID 3920 wrote to memory of 4292 3920 net.exe 101 PID 3052 wrote to memory of 3204 3052 Logo1_.exe 45 PID 3052 wrote to memory of 3204 3052 Logo1_.exe 45
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe"C:\Users\Admin\AppData\Local\Temp\426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93D4.bat3⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe"C:\Users\Admin\AppData\Local\Temp\426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe"4⤵
- Executes dropped EXE
PID:4156
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5008
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4292
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5806c56b4f1c79375f1f1283272042133
SHA113639705ca7ba144fe7fbf9d91cbf94204dee251
SHA256e114ca92444ee60417e23449cd9df3f2dbb0f03b89a820ac239b96d3f4c7340d
SHA5126c4e0242baea4236a092d87d5553e27ea40d6fca260b01fd4260f1e83a2aa0f71c06ac9b4cc10a661b80286addb0370df39ef8327a5ab73f7b795a80f8191ac7
-
Filesize
491KB
MD56d9bdfea8c3d164ff5a67f5a022ff1f4
SHA13ecfcd1fd7ff5c85d243ce2c9218ddd9d799d983
SHA256d26cf7173e56cbc5dd91402ef4b5f11f257c32595ef5569945452878780c983a
SHA5121814f5f8991cf6fe35e7912190db3c98a29e561764d50c3ae43ecf28df314c8a926fd2ff9440bfd73574cf5f0020cd8b24fd341aaba77f0c5d8bcf7eb7d2f838
-
Filesize
478KB
MD572c34333e3dbd45b5766d444f1d55b09
SHA1434ba6612e225de1883f1259e237dd2d451898c6
SHA256cb0ce66f231069c917c9038ef008e456213a0766d89ec65b369243a9668e9080
SHA512b52d0e80b16fe4db8cf7a0bc9bd0adf26dbac25ea68ae754dcde17f146cc494ee1a0c0b97f20236d840f7e286be0e3e5eab342f694af8876edef93b240c16fe8
-
Filesize
722B
MD522454f4a16a8920ac5dfb7327c8b2e9c
SHA16999e3e5632b4d38c213f1fe769c2c83712111be
SHA25662326005f7da9cc033cd65e506c94073ea2c6af74b54b4ebef2ec128645c2389
SHA5123185176fb803c4eac3e2192bc090a3d7f54000c3c1fa1d48802d0a080bcecd771899291e3a3d3c064015fc81f440d258d5f810c8a1393012d0b6a8ccc04e30d1
-
C:\Users\Admin\AppData\Local\Temp\426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe
Filesize2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
C:\Users\Admin\AppData\Local\Temp\426b18d6ef1280bc4c2d4746c58aa6b4d80ca198ca53d6bc8b5d509067cbb018.exe.exe
Filesize2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
Filesize
33KB
MD50b6156999b5b4bfd7c933e0272c7d732
SHA1c828379a55ade751d43929827ae928773ee7da29
SHA2567bc8d0e4ec426448c34caa6c599b7d93a37263ac7e783dc7adae46aa04305cbd
SHA5120e32d0a67572b5f5619ea4ddac07ecd12d2bbac1b442a4af3d87992439a2e443557383f1545020b5650e6a1225d0f0c8aec12e2889fe0d8e852720ceed12dd5f
-
Filesize
33KB
MD50b6156999b5b4bfd7c933e0272c7d732
SHA1c828379a55ade751d43929827ae928773ee7da29
SHA2567bc8d0e4ec426448c34caa6c599b7d93a37263ac7e783dc7adae46aa04305cbd
SHA5120e32d0a67572b5f5619ea4ddac07ecd12d2bbac1b442a4af3d87992439a2e443557383f1545020b5650e6a1225d0f0c8aec12e2889fe0d8e852720ceed12dd5f
-
Filesize
33KB
MD50b6156999b5b4bfd7c933e0272c7d732
SHA1c828379a55ade751d43929827ae928773ee7da29
SHA2567bc8d0e4ec426448c34caa6c599b7d93a37263ac7e783dc7adae46aa04305cbd
SHA5120e32d0a67572b5f5619ea4ddac07ecd12d2bbac1b442a4af3d87992439a2e443557383f1545020b5650e6a1225d0f0c8aec12e2889fe0d8e852720ceed12dd5f
-
Filesize
9B
MD5872506f1dadcc0cedd1e9dee11f54da4
SHA1d1e87145ed1d918f10ae4e93ccdbb994bc906ed5
SHA256a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104
SHA5126cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c