000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939

Analysis

max time kernel
173s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
Size

26KB
MD5

ae26fc09106ef9dc7e9ade522fa68b02
SHA1

089067f07b53c0123ffd5b576055de16e7e44d74
SHA256

000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939
SHA512

22aaa03ae403650c67c34a51d8ab94e48d23a0fd448c7b43be232c93a9b1d4b69fdda639f44bc923bbb3af300b62e2c055394e09fdf503fe4e5c3b0a756da8cd
SSDEEP

768:gciVA1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:gvVSfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\U:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\T:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\S:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\N:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\M:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\L:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\X:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\V:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\K:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\H:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\O:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\I:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\E:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\R:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\Q:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\W:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\P:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\J:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\Z:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened (read-only)	\??\Y:	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.8.0_66\jre\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\jfr\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\MSBuild\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\bin\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\images\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Google\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\management\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4476	1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe	86
PID 1184 wrote to memory of 4476	1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe	86
PID 1184 wrote to memory of 4476	1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe	86
PID 4476 wrote to memory of 1656	4476	net.exe	88
PID 4476 wrote to memory of 1656	4476	net.exe	88
PID 4476 wrote to memory of 1656	4476	net.exe	88
PID 1184 wrote to memory of 3172	1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe	43
PID 1184 wrote to memory of 3172	1184	000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3172
- C:\Users\Admin\AppData\Local\Temp\000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe
  "C:\Users\Admin\AppData\Local\Temp\000a5a6eb5145fa5f6efca8c651e71df66fea96e76d65e45571a0a1bf9b07939.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
4d53f7f08850be3aac32f77467ea358e

SHA1
0058cfe802e013432109546c1854701f5e3ce69b

SHA256
7acec6c051c64ad4cd7a1d2be047b2fb8a04f1a730802c98071dce72d4e18498

SHA512
f748c75a832fbe695328212d1663768fd8776426a3574b0aa8bfd4fb240ff4cb026c896581a9d96d68291728fb01f837d4e10b482e35292e3a402741734810e0

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1574508946-349927670-1185736483-1000\_desktop.ini

Filesize
10B

MD5
dbf19ca54500e964528b156763234c1d

SHA1
05376f86423aec8badf0adbc47887234ac83ef5a

SHA256
bfa0ad2e861e2369dc239edf8f62fbe1c4507d877ec2f76e46e48f1e68fdd5ae

SHA512
fb8ce1253ad6d3c1b7d970614dbc2d21574576336a490b54a8dc705a3d8637c0669747ba821fb2f4da14d7447dc24607aca988b0cd3bd9fc4d9d5988b4b631d0

Download Submit
memory/1184-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-493-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download