057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
Size

29KB
MD5

0a4ec07af6ee0de7e8639ccfc1e0a98b
SHA1

c3f8a375dc91e1436f5da51fc529535ff616103c
SHA256

057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477
SHA512

dcb37d95aae4c7541058ef68ac0c3931b67a3fe61bbe569a6ff0ab87754760b5720c3df6d2dad6c5e627eaa50e268c066a20bbdb11123d3965c17cc650f45ae0
SSDEEP

384:NbbNMWe1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pZne16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\V:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\O:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\J:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\W:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\U:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\T:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\G:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\Z:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\Y:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\R:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\L:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\I:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\H:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\S:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\Q:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\P:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\N:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\M:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\K:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened (read-only)	\??\E:	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\et-EE\View3d\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1720	1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe	83
PID 1452 wrote to memory of 1720	1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe	83
PID 1452 wrote to memory of 1720	1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe	83
PID 1720 wrote to memory of 4052	1720	net.exe	85
PID 1720 wrote to memory of 4052	1720	net.exe	85
PID 1720 wrote to memory of 4052	1720	net.exe	85
PID 1452 wrote to memory of 2564	1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe	36
PID 1452 wrote to memory of 2564	1452	057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2564
- C:\Users\Admin\AppData\Local\Temp\057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe
  "C:\Users\Admin\AppData\Local\Temp\057b872ff99ac74d06c69d68bc60cfe8c3842d858e79fa7aaf6e52b62e945477.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
81b366cea7b26125940709a0f5e7d254

SHA1
6e03a61b1a9486e275754a58f5927ee2168d12aa

SHA256
790683ff65c5feabb356270eb6df40bf11d1f9d077383695d2beefefc925a0ad

SHA512
a48c74c21e439233ab92bf16c6a1207bb76aeaa0d1e89a939e2539f44902fde3d39a1b3589982566b5f2713a250493e10e0a2ccc74ead91f6a86e6106f8b472f

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
fcd5fa32831d2ad12b38c397964f1d76

SHA1
a8ded95fd14fc774ccecaa349bafae2fe1104845

SHA256
52589a563c6c2ea296d87d7051baab3715669c06b694e80aa136543ade71aacb

SHA512
56f8e85f13090bbb6a6cf41f7e7a3cb3370ef7e7cec97e0a2f81edf059527ae06467bf55b4de821fa6c527f25ea01049ecda7a969d671e0d32f84b8e05ecef1f

Download Submit
C:\_desktop.ini

Filesize
9B

MD5
872506f1dadcc0cedd1e9dee11f54da4

SHA1
d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

SHA256
a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

SHA512
6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

Download Submit
memory/1452-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-1264-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-1268-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-4018-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download