Analysis
-
max time kernel
100s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe
-
Size
31KB
-
MD5
b756e0071add3e9408c34890bc1cac77
-
SHA1
7ad28bf40d2c31342086f74a8e58ba358f36fa48
-
SHA256
cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c
-
SHA512
d1e1c6ad12e266030c68c6833cdfbc05e2f4cc6cca4b8ae7a9287ccdb7caa39fb2868da853251e7adcda79a73f52b8dbfd5be0330223cf3c9a809e2f0c94daba
-
SSDEEP
768:2KF5BaJ3rnLg3FISrlZHqcol2NReG7h0QSUXVzq0c0F:2EMAISrlZHNoANReSzJq0c4
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\L: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\J: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\I: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\W: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\T: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\R: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\E: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\Y: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\X: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\V: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\M: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\K: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\G: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\Z: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\S: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\Q: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\H: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\U: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\P: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened (read-only) \??\N: cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Internet Explorer\es-ES\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.25\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Java\jre-1.8\lib\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\_desktop.ini cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2872 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 88 PID 2444 wrote to memory of 2872 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 88 PID 2444 wrote to memory of 2872 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 88 PID 2872 wrote to memory of 404 2872 net.exe 90 PID 2872 wrote to memory of 404 2872 net.exe 90 PID 2872 wrote to memory of 404 2872 net.exe 90 PID 2444 wrote to memory of 3352 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 78 PID 2444 wrote to memory of 3352 2444 cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe 78
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe"C:\Users\Admin\AppData\Local\Temp\cbf4b6420b44b5144b9d1e78a966b230d1ca4d14bfe2d942e355eb660e08f15c.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:404
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9B
MD50b7b9562015af2b7e19efc062b59ee14
SHA1bca831ddb43ecb24747e57434d4b443497801c21
SHA2567ef40a98b77a81085c0a426908276cbaead1573daf25f79344d7b4502d953774
SHA512bd3c5f0408ac0ad1b82734cc0c4aca5fa6c96c901307f2e85dc4ce6d1db5a91ac6f7e4794e84286813fd94c648665a94f3496e5d22f6b0f624af4b795871f5a3