Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
25/01/2024, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
- Target 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe
- Size 26KB
- Sample240125-v4glnscfbr
- SHA256 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc
- MD5 f2cd6007528300a8009ed1a42b1c2e95
- SHA1 94050956f9e353a5f9046945d7319cca5b312abe
- SHA512 284a090449cc06f5eb0394431b213c6e8958a8fe5c884b89c7ab259c3f5fc9be84d024479d85603c05dc1d3801441e1a8a394963573a9b4ef0025acff61d136d
- SSDEEP 768:61ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:8fgLdQAQfcfymN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\N: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\G: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\W: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\V: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\P: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\M: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\X: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\U: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\T: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\O: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\L: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\E: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\H: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\Z: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\S: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\R: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\Q: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\K: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\J: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened (read-only) \??\I: 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\View3d\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-TW\View3d\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Microsoft\Temp\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\beeps\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\images\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-dark\_desktop.ini 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1996 wrote to memory of 4512 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 85 PID 1996 wrote to memory of 4512 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 85 PID 1996 wrote to memory of 4512 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 85 PID 4512 wrote to memory of 3944 4512 net.exe 86 PID 4512 wrote to memory of 3944 4512 net.exe 86 PID 4512 wrote to memory of 3944 4512 net.exe 86 PID 1996 wrote to memory of 3436 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 41 PID 1996 wrote to memory of 3436 1996 4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe"C:\Users\Admin\AppData\Local\Temp\4899397070cb1ff124ff7457b43e872fd6c3d06d854bfffb4d8cdc112f9db6cc.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵PID:3944
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 251KB
- SHA256 22c6e725220677df66e6d50263bcb238c7142f816725af54c371bc55975379bd
- MD5 56e508339984e36e9c97830b83585181
- SHA1 afd30df8b41553d9d7ef18f576ee7ef18ced4452
- SHA512 6f4a7833fc4800b835ad4c1f5ddbf1955ba5df930cc63f3dfcf7664d2915accd384c0353a0290e5d3389b1500a118007d8270ff3092769e7afb261001702bcef
- SSDEEP 6144:nVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:V7+AitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 165KB
- SHA256 dbd95cfd04c7d28f06208822092844550fcd281d1178e27b0968b4e74e39b1c8
- MD5 e3802a43bc1898362010b4c7d9677a92
- SHA1 90032ba39b656afed50b7082ad916548d6dd5e33
- SHA512 1386257692c7e6773d01437466e202917c5c0bbcc0a6fa4effd60d2441045934cf57f4b1c3d6f604b6160b111a775ef0567c378f8efed83dcab620c173c43b36
- SSDEEP 3072:8ftffjmNrbFnBS1RkLRXo1ID0NBi+fgKwJP:EVfjmNrbFnBS1R8gq0NBi+fk5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 481KB
- SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
- MD5 1db5b390daa2d070657fbdb4f5d2cc55
- SHA1 77e633e49df484b827080753514cc376749b0ceb
- SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
- SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3803511929-1339359695-2191195476-1000\_desktop.ini
- Size 9B
- SHA256 eea67eaefd0090abf13b8b67f5d4692e6d8364edb3627775a60c6d67962187e0
- MD5 17dd96321b176e3561b64c6ca18fcc3e
- SHA1 eeeb96d6ade3aae107d13dee64261ae3abe01ca9
- SHA512 d7cb68c3d7da341df9c36b5e778876fee0df4e60d546e0c6af1994a4dfae20ca576dc879d5f4f311b38cc780411aa905d347857e11b6c099282ff7cc8be1fe36
- MD5 SHA1 SHA512