25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
Size

26KB
MD5

aa81527202a31901a862980388c26325
SHA1

6bb4788475984392f7edd3901eeb795681669a8c
SHA256

25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035
SHA512

8f47e39839522d7ae6f7ed091eedb2f339637a93154af03a49163bee218bf007fddd091f9debbb776326e76861c1489f64c628218872891ee8e5990ec115e70f
SSDEEP

768:/1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:tfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\L:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\J:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\I:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\G:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\X:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\T:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\S:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\H:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\E:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\Y:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\U:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\R:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\P:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\O:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\K:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\V:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\W:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\Q:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\M:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened (read-only)	\??\Z:	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\View3d\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hr-hr\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ko-KR\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
File created	C:\Program Files\Java\jdk-1.8\_desktop.ini	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4012	2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe	87
PID 2848 wrote to memory of 4012	2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe	87
PID 2848 wrote to memory of 4012	2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe	87
PID 4012 wrote to memory of 1468	4012	net.exe	89
PID 4012 wrote to memory of 1468	4012	net.exe	89
PID 4012 wrote to memory of 1468	4012	net.exe	89
PID 2848 wrote to memory of 3280	2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe	39
PID 2848 wrote to memory of 3280	2848	25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe	39

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe
  "C:\Users\Admin\AppData\Local\Temp\25f91dbdf33a79d04ef3286b0184b6cf7571a6809f412eb465c0851a1725c035.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
c3d4c0154ae8b003a1153c9068b0dfef

SHA1
a80a846b2eea08845e96bc151b53078d48cef779

SHA256
390da8c73d321cc1ad02eb3425021590c5367fe86d1135be11beed121bb7f414

SHA512
17f67aea0a4be721636a93a4fbcdf6037e7995dbca7e7884b59efceaa8a3e600214addd2145d4dbf6a2680f02c5a74ccdc44ab7ae5e451e0be6241fe906f8d1c

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
3470033b19e6d4233d108c41861724ee

SHA1
dda0c0bf37d88e0b1ebe2466990976b85a198e26

SHA256
b1da986a196bf484fde4c8c0099681913294079745da85aeb88e92d1dfac4074

SHA512
c3d0b8b99e3a24032656608f3f57fd5f77d91d822db50368df6a1cdd4f3941087108ce41b02b49086f88bb47826ccee5a1f69b2810671e8d3c5be06bc1e3daad

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3811856890-180006922-3689258494-1000\_desktop.ini

Filesize
10B

MD5
e0b221b9338753deceb4d4e7a6bf13e8

SHA1
56521251ff5aab737b3617dd82eb07df74ad588f

SHA256
3e46e7e2c6c9cf629a9230a5b1c5b196f727959b334cbb517641244ec5c4b065

SHA512
391e4ed4ed44dc677fd663677cb7e69e4c23e4a3629940e46cf757d812395a7876a93c3568d12e5dd99e06b7068e22397694cf54723efa3f0f5789b9687b5810

Download Submit
memory/2848-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-158-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-1070-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-4632-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download