311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
Size

29KB
MD5

d63b0a38dd57c953778fc6996dced7b8
SHA1

4c03454a4597f218de1a9c531fe68de370f211c6
SHA256

311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97
SHA512

c4d6bf7eb7123d3f0ea709cc992814016cd13e50b4b3534518d6d66893b37067d76aaa6cd62dc9b646ce684a6da1a4d3900ed12f3e21fb03ec56a6cef4c4a0f0
SSDEEP

384:NbbbKDvJ3IS01Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOj:pGJYS016GVRu1yK9fMnJG2V9dHS8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\W:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\U:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\Q:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\O:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\M:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\K:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\Z:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\R:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\N:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\J:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\H:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\S:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\P:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\I:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\E:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\X:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\V:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\T:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\L:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened (read-only)	\??\G:	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\Views\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\Windows Portable Devices\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\beeps\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\Uninstall Information\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\MovedPackages\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Configuration\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2552	4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe	86
PID 4808 wrote to memory of 2552	4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe	86
PID 4808 wrote to memory of 2552	4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe	86
PID 2552 wrote to memory of 2132	2552	net.exe	88
PID 2552 wrote to memory of 2132	2552	net.exe	88
PID 2552 wrote to memory of 2132	2552	net.exe	88
PID 4808 wrote to memory of 3196	4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe	42
PID 4808 wrote to memory of 3196	4808	311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe	42

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3196
- C:\Users\Admin\AppData\Local\Temp\311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe
  "C:\Users\Admin\AppData\Local\Temp\311d4debffce8604501fbc5f49c9816a09005a228111e8fb2d32c40a57446b97.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
9c4394c2f68bf5ea9d8b771a1db879de

SHA1
72161ebb916656f721d2598c53ffdb8e5c26318d

SHA256
04657e60b91c633b3ec4c4678539ee0573f3e744d5f3fb040ec5dbfb74a51105

SHA512
507769da00e1f04172e1a78cca06d8ff702484ded2b98acdf28023cb37351c656fd20d0ab8b6d20c4ec7f972e77e77594dd10192a5622ebde08ba6bdcad27976

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1114462139-3090196418-29517368-1000\_desktop.ini

Filesize
10B

MD5
b37b393b54a7359a4db72d7ede7217d8

SHA1
f72b757d8b265002cdbb349b309817684b06c790

SHA256
b2a681fd703549670a45f0f394a78843add6199a491ec7194d74454e7fa717a7

SHA512
7da2eacf26b7627db3ae5f29780bb8750b618f4e56b5b6576cae090c49b417c74d0df7402c6d07d9356004a70f5e9b968c14847d652df627d6a00227966f1772

Download Submit
memory/4808-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-283-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-1070-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-2163-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download