188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
Size

26KB
MD5

d2d2a40536baba535c73db8ebf952282
SHA1

b4d82964a3fe7dbbda65c98303290e457c0489ee
SHA256

188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e
SHA512

94798e9737bd080a58d9643769204c1bca3aacfdd65e0896f847525c40ea58959a684e0df13068c930e4de98447d684435dcea2b3a35db918924022f70af0b54
SSDEEP

768:H1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1:VfgLdQAQfhJIJ0IO61

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\S:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\H:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\E:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\Y:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\P:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\N:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\J:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\Z:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\Q:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\O:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\L:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\X:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\V:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\T:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\R:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\M:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\K:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\I:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\G:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened (read-only)	\??\W:	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\he-IL\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2712	1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe	84
PID 1492 wrote to memory of 2712	1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe	84
PID 1492 wrote to memory of 2712	1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe	84
PID 2712 wrote to memory of 2992	2712	net.exe	86
PID 2712 wrote to memory of 2992	2712	net.exe	86
PID 2712 wrote to memory of 2992	2712	net.exe	86
PID 1492 wrote to memory of 3412	1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe	47
PID 1492 wrote to memory of 3412	1492	188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe	47

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Users\Admin\AppData\Local\Temp\188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe
  "C:\Users\Admin\AppData\Local\Temp\188c643214553172b88465e1555775bbee2f38e8aade04abd70e952bfb22fa2e.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
67c74b97c2071187d39ee2e50ac48fcf

SHA1
fde80377c7e7dc46324c9bc948098f57c8fbc374

SHA256
416e5e449e430cd27534878cc952014e862505b3cba07927ede5a25eb095ed6a

SHA512
7c91dd105eaa54bbdb168422d65b9d5b0cd3af748a117c36a6c276fae55d809eb9c3acdb71a8e58d2a2879dc13a7a78a6473ecaad1c2737464e2d33f25fd345b

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
710KB

MD5
274a1e0064ca941ba9ab3f5bacf922b3

SHA1
c72a9d01ee2b518f7ff03d09a5c0a536ed77867e

SHA256
2603ee540fb51565dfa2f75db545d7856122aea710ab5f31df5255b613f74c26

SHA512
6f900bd9feab4cff3cdf7c3cb0956636147d68ddddd5cf8a91821394141330ebc2682825b65a835fa1d2a71155a7879002f2994c0d3d3c0b7897fad6c0e3ed65

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4123566616-543693798-272350410-1000\_desktop.ini

Filesize
9B

MD5
b347a774e254ac3f0d6aaea35544ac50

SHA1
7f332d15a7648f7a698b3068a428811361f4e9ab

SHA256
1ebd1b85bb264260df3d9fb0a2062b29199c7b6137dcc98486874c1d257c73cd

SHA512
ce8615c90c8794f0aefeb0c6ce5da126732695e6be36b5e625f3a073d55c6f8cd88ca465b07e2c0e87355b5baad887a3f0b26c4eb262484a83d35565e72ba138

Download Submit
memory/1492-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-202-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-1152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-3649-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-4704-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download