Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2023, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe
Resource
win7-20231020-en
windows7-x64
10 signatures
150 seconds
General
-
Target
fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe
-
Size
205KB
-
MD5
8dfccea5352f1cbaa222be3a97295a04
-
SHA1
9fa21ee3307dbf70beef9ea2591b1296911076e6
-
SHA256
fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289
-
SHA512
fd11aee0246f6456d1994bf56d4992ee9b45f33149b625afeee7dd0d505fbf9c8cea48eb3e6c9a7836bd1e8d055bdddcd1931b2ac5bf564ce036192a82d6dbb7
-
SSDEEP
3072:KLe9e+ay7hlZQuV94G2mxtZZVl1dbzxtJB3Stk3MAsasMASY49b/EUe:a+ag3VlLbzxtJB3StqMBasMtF/9
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4484 Logo1_.exe 1988 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe File created C:\Windows\Logo1_.exe fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe 4484 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3056 wrote to memory of 5020 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 90 PID 3056 wrote to memory of 5020 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 90 PID 3056 wrote to memory of 5020 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 90 PID 5020 wrote to memory of 1304 5020 net.exe 92 PID 5020 wrote to memory of 1304 5020 net.exe 92 PID 5020 wrote to memory of 1304 5020 net.exe 92 PID 3056 wrote to memory of 4288 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 93 PID 3056 wrote to memory of 4288 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 93 PID 3056 wrote to memory of 4288 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 93 PID 3056 wrote to memory of 4484 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 95 PID 3056 wrote to memory of 4484 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 95 PID 3056 wrote to memory of 4484 3056 fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe 95 PID 4484 wrote to memory of 2356 4484 Logo1_.exe 96 PID 4484 wrote to memory of 2356 4484 Logo1_.exe 96 PID 4484 wrote to memory of 2356 4484 Logo1_.exe 96 PID 2356 wrote to memory of 2684 2356 net.exe 98 PID 2356 wrote to memory of 2684 2356 net.exe 98 PID 2356 wrote to memory of 2684 2356 net.exe 98 PID 4288 wrote to memory of 1988 4288 cmd.exe 99 PID 4288 wrote to memory of 1988 4288 cmd.exe 99 PID 4288 wrote to memory of 1988 4288 cmd.exe 99 PID 4484 wrote to memory of 3576 4484 Logo1_.exe 100 PID 4484 wrote to memory of 3576 4484 Logo1_.exe 100 PID 4484 wrote to memory of 3576 4484 Logo1_.exe 100 PID 3576 wrote to memory of 3992 3576 net.exe 102 PID 3576 wrote to memory of 3992 3576 net.exe 102 PID 3576 wrote to memory of 3992 3576 net.exe 102 PID 4484 wrote to memory of 3292 4484 Logo1_.exe 47 PID 4484 wrote to memory of 3292 4484 Logo1_.exe 47
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe"C:\Users\Admin\AppData\Local\Temp\fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a144E.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe"C:\Users\Admin\AppData\Local\Temp\fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe"4⤵
- Executes dropped EXE
PID:1988
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2684
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3992
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD551b4f29d8825bd236efcf815393c5456
SHA1a2122d7e87d69d3a7695ff8f26a33fb8c388ad8e
SHA2565a2621204f714473e1749c17a1dc19ae693009cbe68a25ddb0923df9b9d0d7ed
SHA5120e11f9781f332255016567d599c444ed784ced58091d034547646273bdc5f21c71bc1e125ae138e30cbfa7202e557152f629a7700ecd8543aee75cbf84023220
-
Filesize
491KB
MD5fed08aef33778b8ce0323f8defa25fab
SHA171d9cbe9659290f07f921c5369612caeb613cad7
SHA2568911b5eafcb57a92f9ae0c91a6c823955f91baf51e23d2ec204104e16297bb86
SHA512fa308728c7a4de360bf93434eaf031dd46f7ff7a4649e6070b09beda5fdc7b04e6d6b7c2290149ddbac05c64b4489546869ecd58a63a49afb764da689f6800b6
-
Filesize
477KB
MD5e51ebd598953336c3e9723c561316b29
SHA162c6d722e609183d949dc73731b453e7abb52c5a
SHA2565e51232e5175d937e474c66b0e662b43a71432be7c5cbddc71615424385a62e2
SHA512b42567b0a7114d28c6d400b835f7154fc8f6b0bac1ff6da79d66027cea550676e849614aaf4cc5002acfa123476246d68976f0396c24906009d09a72d79ae9ac
-
Filesize
722B
MD5625f2fa879a1a041e4c37226b805d8df
SHA1e8fd35447ef4ccf3d8a94fbda46ef2e60fc49ac6
SHA25661c4f14e9f2dacd2fb881172d8a34bdc542a32120921f3f924c6c2b88f17d269
SHA5120b1bb41d2abe2f89d65f523ecb106abc5114bb35ae6c70702622f7e35cbca33bb0c90db112c9966b54a42ee36e99f5a2bc99e6930eca7f3594173c21489ba97e
-
C:\Users\Admin\AppData\Local\Temp\fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe
Filesize172KB
MD539b89cf25d3f4c7a2f880e06b30b4f65
SHA13b1072078c39ab50f35f2fbabc35c2710b0a7cba
SHA256cf785245b09cc9f4fce024ba1e76e822a0ddbc03a0463397b0f45a80980f4c07
SHA512625b4be3fa64ccde093ad26e2bf92e53a821b337c6ca03f2c8faab4584127df9489fafae42254ffec1ba553f0275e166da99e3ec49cde2a719e97499b9340db4
-
C:\Users\Admin\AppData\Local\Temp\fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289.exe.exe
Filesize172KB
MD539b89cf25d3f4c7a2f880e06b30b4f65
SHA13b1072078c39ab50f35f2fbabc35c2710b0a7cba
SHA256cf785245b09cc9f4fce024ba1e76e822a0ddbc03a0463397b0f45a80980f4c07
SHA512625b4be3fa64ccde093ad26e2bf92e53a821b337c6ca03f2c8faab4584127df9489fafae42254ffec1ba553f0275e166da99e3ec49cde2a719e97499b9340db4
-
Filesize
33KB
MD573a05d5388def9405415e6cd7390df4d
SHA12e10cc2222fc689c769b8b038d00ea26864a27df
SHA2560ada5eed7317cc425ba228162d217403a47d541776b43326289ffcb6e1a2b62d
SHA5128a022de23eb39987b0b881ead96fff79f5c707d7e82e4c3725c90930cf49020cda19f588604494ef1ba580be4f172f15b07baefd2f0ef52a6248c06f43f6fd4f
-
Filesize
33KB
MD573a05d5388def9405415e6cd7390df4d
SHA12e10cc2222fc689c769b8b038d00ea26864a27df
SHA2560ada5eed7317cc425ba228162d217403a47d541776b43326289ffcb6e1a2b62d
SHA5128a022de23eb39987b0b881ead96fff79f5c707d7e82e4c3725c90930cf49020cda19f588604494ef1ba580be4f172f15b07baefd2f0ef52a6248c06f43f6fd4f
-
Filesize
33KB
MD573a05d5388def9405415e6cd7390df4d
SHA12e10cc2222fc689c769b8b038d00ea26864a27df
SHA2560ada5eed7317cc425ba228162d217403a47d541776b43326289ffcb6e1a2b62d
SHA5128a022de23eb39987b0b881ead96fff79f5c707d7e82e4c3725c90930cf49020cda19f588604494ef1ba580be4f172f15b07baefd2f0ef52a6248c06f43f6fd4f
-
Filesize
10B
MD566a297bdfb8bca17fc70dc7aade38f80
SHA1c131517df089bd22d314c2ad490b391e599e409c
SHA25620b72f923ff58cec359f33b5443b5bc5f5c638b719b6df50a73313c23a434ff7
SHA512c329a6351d692301d88ed2e94afde11919aa2b11b851ae662eed9a8468a61e4e14d1cf0487baf4424047f76bfc1c66b7402794f787638e0bd0da01d03cc25509