885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
Size 26KB
Sample231006-m3glaaag4v
SHA256 885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb
MD5 f26d47b7b49b5cabae46e098e2f2f573
SHA1 a948e18655c6feb207e54edf4a61c206e52bd5ac
SHA512 299b826505d44929c203ab49663b0f0d8b1013170955696abe7841d8ed38828677f33e3bda73cad3e8bc43ea1bd0f387719ed3cc590b6661d61b0085c5620544
SSDEEP 768:361ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:38fgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\T:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\G:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\V:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\X:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\S:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\M:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\E:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\Y:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\Q:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\P:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\L:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\K:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\J:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\I:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\R:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\W:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\O:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\N:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\H:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened (read-only)	\??\Z:	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Common Files\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\tr-tr\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 5112	540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe	85
PID 540 wrote to memory of 5112	540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe	85
PID 540 wrote to memory of 5112	540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe	85
PID 5112 wrote to memory of 4568	5112	net.exe	87
PID 5112 wrote to memory of 4568	5112	net.exe	87
PID 5112 wrote to memory of 4568	5112	net.exe	87
PID 540 wrote to memory of 3148	540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe	47
PID 540 wrote to memory of 3148	540	885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe	47

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3148
- C:\Users\Admin\AppData\Local\Temp\885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe
  "C:\Users\Admin\AppData\Local\Temp\885c8ff2334ee2e74f9e8b43befade6db30d158be20a6165e94ac0226e8a86cb.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 34fd0cf1239c2ab134407ee9699b23811ac58b87afeee39224130a15059bf095
MD5 494597f4180eace5e1e267bde6eb400e
SHA1 f4b397ea7fc08bd3ebb8b8b3195d7b955f662b3a
SHA512 576eafbfa2519e496e5613f1e4a1bc59b32627e181e50d700814ee2dff25a1673a0eb7185eb40ca9e4453c98b8eaa5b62fd46d0ee82c06388af99fbeb9cefc8a
SSDEEP 6144:ZVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:v7+AitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 2.8MB
SHA256 5495625be98face99022c3d549f6287337f2d293a2fbbdbe4c38e78b0b4928e5
MD5 efb036316d99a5e854112a21f5df48f0
SHA1 e2c4b1d9fc39344dda91dd81516dcace36f87111
SHA512 dc8815c6a90a7176af7c590b3431f46f07cd156e602344b735296efc5660396012a87ab284ef2305fd0c26e00cb339bc51dd566346c76ccaf13ea3b5b332d990
SSDEEP 49152:27z6gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:zd1XdhBiiMa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\_desktop.ini
Size 9B
SHA256 769c2805df29c09bbc9c0b66f571976c3cc1ca8c948c5d778e1d44c4cd531aa2
MD5 ab3d2d93c2a7707bdbc3d265f9e920c9
SHA1 5ec92eb0b92d45852eb2a3d579d9a2e6c951189c
SHA512 d35df77ec39879e45ad1e9085ffc9acd8e5e3c912eb76b5f17068f099fb7a64144739f74b6379afd10726e92f8653243a7476e83d35cd4c35dc7e39124a22850
MD5 SHA1 SHA512

Submit Download

memory/540-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-93-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-1264-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-3799-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-5-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-4806-0x0000000000400000-0x0000000000434000-memory.dmp

Download