f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
Size

26KB
MD5

99532c72a6a572c57d501d9c26fa8a2c
SHA1

ca4b441b1d15c71864bcb52b35e289682465522f
SHA256

f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0
SHA512

cb7921f9365c96e693facbd875f8de61e16394c020b91e93cafcf1726f60edf670befe1c98b3817aaaad392ad7614dd8f42cde528c5fff716d401d3795d6d3b7
SSDEEP

768:q01ODKAaDMG8H92RwZNQSw+JnbmQj3FZJ9Vs9XnsD:9fgLdQAQfwt7FZJ92Bs

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\U:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\T:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\R:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\P:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\L:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\X:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\S:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\Q:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\N:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\K:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\H:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\G:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\Y:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\O:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\E:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\W:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\V:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\M:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\J:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened (read-only)	\??\I:	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Bundle\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\Windows Defender\ja-JP\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4740	2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe	84
PID 2468 wrote to memory of 4740	2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe	84
PID 2468 wrote to memory of 4740	2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe	84
PID 4740 wrote to memory of 3428	4740	net.exe	86
PID 4740 wrote to memory of 3428	4740	net.exe	86
PID 4740 wrote to memory of 3428	4740	net.exe	86
PID 2468 wrote to memory of 3160	2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe	38
PID 2468 wrote to memory of 3160	2468	f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3160
- C:\Users\Admin\AppData\Local\Temp\f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe
  "C:\Users\Admin\AppData\Local\Temp\f40b30fab8230286d47616abb1d04090c6dcfa33fd1ece6a767586477376b4b0.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
7e6e7ba916c50f31ee0f62efba0ce4dc

SHA1
23e010038b850f2271961285cddb5cc79ca5cde2

SHA256
d74096fb8a13abcb4460081ae5f05fbb3cefbf1ad60a5949084d520e9a911f7d

SHA512
1b2d74f660ae02bc5c533114d0befdf17af802290d3738c1458913595e0eee263c9dceca35670c48b574a4e3b85783bf824bcc3a364cf85df74ff391b576c493

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
27dcecb87aedb60f44e6de64b461890a

SHA1
951aa8c085d096256c669e719ce07a298492d077

SHA256
2948bf841dd409c274903ade0bd9c8f7878761c048e969ee400d10ebd4ee6dfa

SHA512
465108594fd554a71f869edc074f46515e4da4520886603f1dd4b82b6f0188cdc2592316d00f5100626aff3114d17314f39c31995436d6deffe7dc1f9d9dacbf

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\_desktop.ini

Filesize
9B

MD5
2c012c1af0648018cb6d8f5d91a5a1df

SHA1
a55ab94d1fdb3374bee98660f16093ebca4e9258

SHA256
50313ae96f06443d8a81be791ed17d2060cbbe0b3ab5675290bf34eabbbdce3a

SHA512
1db76dae120f6de58372c7aec1c84b213242e991bdd92fb1a327b32bb91af55bab93719d55d49ae3712bf0b42998d561960ffe086bb3e42e806acc248ce1664e

Download Submit
memory/2468-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-91-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-1264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-4363-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-4806-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download