fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
Size

26KB
MD5

b6aa1b2ff7935f46847b8470067f2500
SHA1

2b72bfdaaf24129083089f514586261b6717ca33
SHA256

fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd
SHA512

cd13d1dfbffc6d0f515c2c009f31270b131cbd04a5e9c6d7da87e6bc755b497677bd8a7b92e80e34ed92996b3d1cf67dc099af219a951b5bdd7f16046677d21f
SSDEEP

768:gp181ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:mmfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\O:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\L:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\V:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\U:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\K:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\J:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\I:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\H:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\G:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\Y:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\X:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\T:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\Q:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\P:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\N:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\M:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\Z:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\W:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\S:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened (read-only)	\??\E:	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sr-Latn-RS\View3d\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tl\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\Java\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4324	4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe	85
PID 4092 wrote to memory of 4324	4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe	85
PID 4092 wrote to memory of 4324	4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe	85
PID 4324 wrote to memory of 4080	4324	net.exe	87
PID 4324 wrote to memory of 4080	4324	net.exe	87
PID 4324 wrote to memory of 4080	4324	net.exe	87
PID 4092 wrote to memory of 1980	4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe	38
PID 4092 wrote to memory of 1980	4092	fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1980
- C:\Users\Admin\AppData\Local\Temp\fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe
  "C:\Users\Admin\AppData\Local\Temp\fe701646818df815e6cb3e26621e874a8d598545c26044e17dff1b644ebd7ccd.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
d284596a2f6500f2b2507f019006f537

SHA1
bd1c9ec2a3364ddce7189c6cdd9ccaea54f3d72c

SHA256
2573750654dc06389e06718086dfd0230ec9b7477986c2844fc34ef0bbcde5c5

SHA512
c9e4d69b2c5321b6cf04e092c90ef3e58ab1eb6bf47c0b1d9b8b754704d9a00531ddfdaacbf5e88cf55b797f7867d184da3876689e3e42bf7e4e4356f29ea9b2

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
4f1a26b67b7aa8cca7f7fe1d12d87fad

SHA1
525f0570ee07d6dd20c23daa45b477304d61b6a6

SHA256
36ff88a16e0fbf589d153d34f11b14f6e8376ddba399d4bc677d58477c38f44a

SHA512
4670de53fb54dc21332146c85d399408dc3dcc933a5a2a027db7d6f5dc9a555f56187adcbb79f7a36b29cf3586994c272390d69cb98ecf3c31f5b8284fac92d7

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\_desktop.ini

Filesize
9B

MD5
2c012c1af0648018cb6d8f5d91a5a1df

SHA1
a55ab94d1fdb3374bee98660f16093ebca4e9258

SHA256
50313ae96f06443d8a81be791ed17d2060cbbe0b3ab5675290bf34eabbbdce3a

SHA512
1db76dae120f6de58372c7aec1c84b213242e991bdd92fb1a327b32bb91af55bab93719d55d49ae3712bf0b42998d561960ffe086bb3e42e806acc248ce1664e

Download Submit
memory/4092-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-123-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-1264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-2761-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-4806-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download