Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe
Resource
win7-20230831-en
windows7-x64
10 signatures
150 seconds
General
-
Target
3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe
-
Size
2.8MB
-
MD5
faf05f39c25cedd88c2cb19c6f5d0b96
-
SHA1
84e52cb8dad24548627f34564a6b903786d4e742
-
SHA256
3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8
-
SHA512
fdb12c779b30152401bdcd8d010710fe29c2b66e4881af90f023875756673de2e6e2a129cda1007911548eda69cf59cd8ae219d5bf44da7b588f3bfc1d3d8627
-
SSDEEP
49152:9C6gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:9Hd1XdhBiiMa7
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 5052 Logo1_.exe 1136 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe File created C:\Windows\Logo1_.exe 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe 5052 Logo1_.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 776 wrote to memory of 3596 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 88 PID 776 wrote to memory of 3596 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 88 PID 776 wrote to memory of 3596 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 88 PID 3596 wrote to memory of 3844 3596 net.exe 90 PID 3596 wrote to memory of 3844 3596 net.exe 90 PID 3596 wrote to memory of 3844 3596 net.exe 90 PID 776 wrote to memory of 3964 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 91 PID 776 wrote to memory of 3964 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 91 PID 776 wrote to memory of 3964 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 91 PID 776 wrote to memory of 5052 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 92 PID 776 wrote to memory of 5052 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 92 PID 776 wrote to memory of 5052 776 3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe 92 PID 5052 wrote to memory of 2040 5052 Logo1_.exe 94 PID 5052 wrote to memory of 2040 5052 Logo1_.exe 94 PID 5052 wrote to memory of 2040 5052 Logo1_.exe 94 PID 2040 wrote to memory of 3080 2040 net.exe 96 PID 2040 wrote to memory of 3080 2040 net.exe 96 PID 2040 wrote to memory of 3080 2040 net.exe 96 PID 5052 wrote to memory of 2732 5052 Logo1_.exe 98 PID 5052 wrote to memory of 2732 5052 Logo1_.exe 98 PID 5052 wrote to memory of 2732 5052 Logo1_.exe 98 PID 2732 wrote to memory of 4920 2732 net.exe 100 PID 2732 wrote to memory of 4920 2732 net.exe 100 PID 2732 wrote to memory of 4920 2732 net.exe 100 PID 5052 wrote to memory of 536 5052 Logo1_.exe 53 PID 5052 wrote to memory of 536 5052 Logo1_.exe 53
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe"C:\Users\Admin\AppData\Local\Temp\3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3F9.bat3⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe"C:\Users\Admin\AppData\Local\Temp\3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe"4⤵
- Executes dropped EXE
PID:1136
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3080
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4920
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
491KB
MD546ae7ad50bf5517fa0c4543e1e81b0a8
SHA18dabd82a87d38b1b7974bf091729765225086f7d
SHA256e7b86a47bfa73d401c6be04d50eab08f10971d23ecb65c551067561161c6d91e
SHA51266f562c97d0dd3e3fc1cb7a173528c04bdaa913852250f6a323341550f8cddbecb0d8e90a0994d1d10d217d848a7e9352260c463505976e805bc8af1e9316d52
-
Filesize
478KB
MD56a7cc95aa1f89e674ceaaf0e47468f09
SHA1a8f49c8c41db5f5aba73ae18aa8db02e7b628b1e
SHA2565cf0a795012be80cd03b3032a945dbbba00126929f4a7dab4fa7e73b3c825ff6
SHA512631814996b48d9d0dc6c4898c1813c1f9aa007102de18c9a30ae027c959831acceb76d732b25a207155f18b750045adb2f75fdfb33232b917b1395d94a73ca61
-
Filesize
722B
MD5f6014c8fe809414522dbda334d034e73
SHA1cfb32da35534c1f1faa8214bc94929dee15fee40
SHA256c8331fbeefb040959649d2a928413841213ac56642a9774f6b51bdd9d7b191ef
SHA51254f2162557b0591dfe91e39b42450f101aa283d3dfcdd77d26079c49fd9a877216b01a78b8bd50ec0034917925c5210bdbe20776c3e14934178f4716ed10d4ba
-
C:\Users\Admin\AppData\Local\Temp\3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe
Filesize2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
C:\Users\Admin\AppData\Local\Temp\3b893a8c2772b1f36a77320430e9908fdb3077a8fd61f8f8dc21cd846b863dd8.exe.exe
Filesize2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
Filesize
33KB
MD593c7e83acc68e02f68b2dc2c6dc904a9
SHA1c505471fbc1e6884cd40dd319ad9f0be37814041
SHA256951df8bd05592efb598d024d201df816305756441d740396e33f6afeee19f8b8
SHA51278fbd979100c4ed8824a62cedf3e2d43b0bc6d7ea5378bc7c066cfdc1cab184ca99786e2e88c466c84af93c292eee777c6b10f5d7940b3637d8e46a32fda88af
-
Filesize
33KB
MD593c7e83acc68e02f68b2dc2c6dc904a9
SHA1c505471fbc1e6884cd40dd319ad9f0be37814041
SHA256951df8bd05592efb598d024d201df816305756441d740396e33f6afeee19f8b8
SHA51278fbd979100c4ed8824a62cedf3e2d43b0bc6d7ea5378bc7c066cfdc1cab184ca99786e2e88c466c84af93c292eee777c6b10f5d7940b3637d8e46a32fda88af
-
Filesize
33KB
MD593c7e83acc68e02f68b2dc2c6dc904a9
SHA1c505471fbc1e6884cd40dd319ad9f0be37814041
SHA256951df8bd05592efb598d024d201df816305756441d740396e33f6afeee19f8b8
SHA51278fbd979100c4ed8824a62cedf3e2d43b0bc6d7ea5378bc7c066cfdc1cab184ca99786e2e88c466c84af93c292eee777c6b10f5d7940b3637d8e46a32fda88af
-
Filesize
10B
MD5a592e6708558f3dc0ad1608608da69c5
SHA169a1224ba3b2f2ab2f2ce8b8287809f3282d20d0
SHA25624c83924da516d8acac4cdc96680306f1e34a8a54696bf5bf24106eeb562195a
SHA51238724fff525de3d5b413bb962c2f81369068403f761f69d00f25cd03b5d8cb83603cd6d23c87faf458f157acf585ca4db031fe6640704a4158cb5ead56ce79f1