3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
Size

26KB
MD5

a51d5488ef6647e5ac9e96cf79c61e01
SHA1

fbceffa2d9f07ad44ca7fcfc65f136b578e4bf35
SHA256

3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333
SHA512

f7db82bb9cfe044e7854d98c25d55c1a868065786ba211b4a5d7af14cca2570dca72ed7af18a6534a06c5ae909d2d391a4dcd2e4af0a15aace40082c26b379bd
SSDEEP

768:Pu1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:gfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\Q:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\N:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\K:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\I:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\G:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\W:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\U:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\S:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\M:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\L:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\Y:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\P:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\J:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\E:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\H:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\Z:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\V:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\T:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\R:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened (read-only)	\??\O:	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\View3d\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsPowerShell\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bn-BD\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3212	2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe	85
PID 2084 wrote to memory of 3212	2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe	85
PID 2084 wrote to memory of 3212	2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe	85
PID 3212 wrote to memory of 3980	3212	net.exe	87
PID 3212 wrote to memory of 3980	3212	net.exe	87
PID 3212 wrote to memory of 3980	3212	net.exe	87
PID 2084 wrote to memory of 3140	2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe	48
PID 2084 wrote to memory of 3140	2084	3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe	48

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3140
- C:\Users\Admin\AppData\Local\Temp\3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe
  "C:\Users\Admin\AppData\Local\Temp\3f1b503bae8d88b6db08d968d39ec676f462a1272563971d022648aeab4dd333.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
11f506a4e210e65031c95f76dbcc1fc8

SHA1
a6ff407684f444f132ac4ac01a902df81350723b

SHA256
9e4ab37f0fca9fc49e8764bd5c480f5f2be1e4d099b47920588e30094671e43b

SHA512
01350034abdad00df8caba5a2bcd25c5efa2aba09bf40e8f99a82bf340c4b34a3e24823160e1d06342e7a2e3dc01422217648f444c4e3d10b3661ed0b28c4760

Download Submit
C:\_desktop.ini

Filesize
9B

MD5
872506f1dadcc0cedd1e9dee11f54da4

SHA1
d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

SHA256
a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

SHA512
6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

Download Submit
memory/2084-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-1264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-1266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-1269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download