faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
Size

26KB
MD5

bcdca6d2167972b1a840681e443e5e6c
SHA1

9c562b56d28373b0a562782e82b676ef00043db1
SHA256

faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547
SHA512

6adbd5608ced2543382e2823b475471ad4d666626839615569b2b12a3a2d3d38389a427235916e502aaf981681b31abf013d6390c6a43f501df7e9d7eca7e853
SSDEEP

768:gF1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:gjfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\O:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\L:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\E:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\Z:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\Y:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\V:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\T:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\P:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\G:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\W:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\S:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\R:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\N:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\J:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\X:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\U:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\M:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\K:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\I:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\H:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-dark\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewer\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-white\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Configuration\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\6.0.25\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 372	4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	90
PID 4064 wrote to memory of 372	4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	90
PID 4064 wrote to memory of 372	4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	90
PID 372 wrote to memory of 4740	372	net.exe	92
PID 372 wrote to memory of 4740	372	net.exe	92
PID 372 wrote to memory of 4740	372	net.exe	92
PID 4064 wrote to memory of 3392	4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	55
PID 4064 wrote to memory of 3392	4064	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3392
- C:\Users\Admin\AppData\Local\Temp\faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
  "C:\Users\Admin\AppData\Local\Temp\faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
165KB

MD5
b03c5b64712355dab610760519c62976

SHA1
63f141b43506ceb121566990edfb09f186e7e782

SHA256
bad657a86c507c8a3575efad7ea18ab90176041ec3db16dd9a9ece3bad4879ac

SHA512
81d3437e1ccfbfee4820f70c6cb2247bc05eaa019a6f221e11714ab24f8bdae275f5f1299db7b34ded6badf9285f7569575afa79ad1c990dfb8cd9af61543aac

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-996941297-2279405024-2328152752-1000\_desktop.ini

Filesize
10B

MD5
fae432e16d94d42a8d76fc8e8371df2f

SHA1
6dac778159c5e1e1e74e34c671f0ea17a2ce02e6

SHA256
58029e3ed60f40e0999a6865c646900fd31a7aad8f7b6724a5f144b3e26aa977

SHA512
bce2a1ee89e19165244986dc8ea4d77ecc9081ae64979f91a3c2d57a54261022ed2aca1e806900f6e71ddcd3a8cf1cd8c73935e1bf3d353baabcc86147af1ef5

Download Submit
memory/4064-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-1152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-1166-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download