6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f

Analysis

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2023 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
Size

29KB
MD5

9661b81f24b7ea820377f79efcf39e77
SHA1

3971ef24a80442913c381b077f2ca2b360178fe1
SHA256

6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f
SHA512

4c527b2015527f17180d5591eb784a71bccd091ab8ef098faaf9c767231a4fbacdb540ff78a8ce015cad364b4148cdd351eadfcd4a552d33c080c1870d5de7e2
SSDEEP

384:Nbbh3QU1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pmU16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\L:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\J:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\V:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\W:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\T:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\R:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\X:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\U:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\Q:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\O:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\N:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\H:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\G:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\E:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\Z:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\P:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\M:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\K:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\I:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened (read-only)	\??\Y:	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\_desktop.ini	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3912	1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe	87
PID 1992 wrote to memory of 3912	1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe	87
PID 1992 wrote to memory of 3912	1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe	87
PID 3912 wrote to memory of 1048	3912	net.exe	89
PID 3912 wrote to memory of 1048	3912	net.exe	89
PID 3912 wrote to memory of 1048	3912	net.exe	89
PID 1992 wrote to memory of 3220	1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe	38
PID 1992 wrote to memory of 3220	1992	6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3220
- C:\Users\Admin\AppData\Local\Temp\6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe
  "C:\Users\Admin\AppData\Local\Temp\6109674a0cf749ef17f95ebb546eb8f785a56f22cef931d131d26970dcb9767f.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
168KB

MD5
d16e7e5aefb8311d659ca8b2dc3cf969

SHA1
7b223e6f36c7f98c1128d75c7494015027ba0bfb

SHA256
c41ea3c8e36a621bf06917af84488ec84aa9f2599632431fbaea6597f807c39f

SHA512
d032c076777d50086c0465428ae401e93b2dd8236df186118a55fb5d26830dc4ce8b60cd3fb7f8abaf7ac07d2b288bbb01a6377c8b7b5ff52797b55b9cac3eda

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3635043082-2972811465-3176142135-1000\_desktop.ini

Filesize
10B

MD5
4661db9bc35ff03ce317c10340aefcf0

SHA1
f0e79b1005d44e64f7166d071630e842aaa38b52

SHA256
2e37d9000ca5065fbf0811fb0284a648a61c808868310caa341a73a6a7dbe665

SHA512
5c3bc77c7f03b7f28b86ce8cf61f6698ac2bd7f1521af9a89bbd81f3feabbc56fd45483d157e0ceae6bcbdaefc29f5f053fd40d45d4b68ce1270c8c0dddb2269

Download Submit
memory/1992-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-1151-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-1562-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-3961-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download