Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe
-
Size
33KB
-
MD5
fb7888cf98a23e5765c04bc5aef7ebf0
-
SHA1
7efbbeea2d8c75cecfdd63f62fe7298d16de4adc
-
SHA256
1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6
-
SHA512
876f9d7b684eecc2a65197d5b9ea98f4ab4054a3c8a361b7970fbd860e34e6d002fc7f226c8ab8169b7d18fefe85565521df9699ef93889fdf80dc8728ef55ff
-
SSDEEP
768:7AE1pQFJFKZj1PVs9Ag1vzbJtF04QJ0bOamJVUJv9H:7AEccx1aeg1v/FMJ0FuVu
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\L: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\J: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\S: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\R: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\Q: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\N: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\K: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\Y: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\X: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\U: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\G: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\P: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\O: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\I: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\H: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\W: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\V: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\T: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\M: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened (read-only) \??\E: 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe File created C:\Windows\Dll.dll 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2332 wrote to memory of 448 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 84 PID 2332 wrote to memory of 448 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 84 PID 2332 wrote to memory of 448 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 84 PID 448 wrote to memory of 980 448 net.exe 86 PID 448 wrote to memory of 980 448 net.exe 86 PID 448 wrote to memory of 980 448 net.exe 86 PID 2332 wrote to memory of 5112 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 87 PID 2332 wrote to memory of 5112 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 87 PID 2332 wrote to memory of 5112 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 87 PID 5112 wrote to memory of 2424 5112 net.exe 89 PID 5112 wrote to memory of 2424 5112 net.exe 89 PID 5112 wrote to memory of 2424 5112 net.exe 89 PID 2332 wrote to memory of 3460 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 21 PID 2332 wrote to memory of 3460 2332 1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe"C:\Users\Admin\AppData\Local\Temp\1e1bc1d081c397d85fcef755f1ee83a9b2ae61c4ff857c9543f7e648f2583ce6.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:980
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2424
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD503bade9086ce1ad5e0bcd5d151b7707e
SHA1593ab85917e16235daae2a703902ce400849c790
SHA2563c0c33b4787cec8a3d32188c69e271f6f6d862a57a663b344bb1f7f661cf6337
SHA512a6a367ff8dada642cf7d4cfb5c333bd617be6aed29089f0ff14581fa33ef1003a5adfb1fc1ec3bf977d8c7ea6ae764f6dbc45da75be263dfebcea9a57618b172
-
Filesize
172KB
MD581dceeb8f8c23550f5b8f1fe7460edb7
SHA129749400503f6b4264de341529bee6e1e92941cc
SHA2569ac023b200731c2ba2d3a10003dc2e0f797ffdf7eab08e597026c34199c4ed50
SHA5126d6845baebdd6751e07cd8dfff66123acb6f51454c506e5c364fa1b5f11b1f28d2659a387bc1516e8abfa1f39346413c475b256014481a3d080436521500ef46
-
Filesize
488KB
MD5de4f99d33c3138d156d2227d1b33c300
SHA1539dffd0a2747a2476194ea4622ce811b777d2c9
SHA256ec479b359747438266f75f97bb50b916d0f27d607e3dd40d8871c299a43cba4e
SHA5124db6e5810373d94603df13bbac362ef5e0d76a5b5400aac1d3d132706058fd69b58b5423ecfd811efe2f925d91fdf137b5a009b6d22a0a8d5fbcf9e300d3b7e0
-
Filesize
9B
MD5656878f7f928e71d7f24b57fcc0f6261
SHA103d784e1d3d642f69b11963a421200e3c046e6e6
SHA256fac18ac822bec04370e7632ba99c7434d4674099af7ba5260689b778a7e13f93
SHA5126df81d09518887c18a145a5866582839e3c8c469111ed260916acf23b759845d3ff4416539f0cd03d74dd0379aea26b247ca14fd54ecf5544a63c7e76edec22c