Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
General
-
Target
a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe
-
Size
93KB
-
MD5
97517e1998bd7e881101a01efe0b4c68
-
SHA1
79b7b6159779aa9d4e09e55d08e5bbefbceac788
-
SHA256
a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3
-
SHA512
7d0ddb4e6bbaf2aac5d8de86c2c269ffa5effd4cdcc2b8ce49f48ed2182413a90fa62205daf6815064e52ca6d5f2758719ea6783e0cd9ba555594ad8b84d1634
-
SSDEEP
1536:cAsxN92ppTSahtA3AWHB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:cfNIv7MwWhAWJGSCTBf12Z9
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4708 Logo1_.exe 2196 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Portable Devices\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe File created C:\Windows\Logo1_.exe a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe 4708 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3760 wrote to memory of 1852 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 81 PID 3760 wrote to memory of 1852 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 81 PID 3760 wrote to memory of 1852 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 81 PID 1852 wrote to memory of 4520 1852 net.exe 83 PID 1852 wrote to memory of 4520 1852 net.exe 83 PID 1852 wrote to memory of 4520 1852 net.exe 83 PID 3760 wrote to memory of 4532 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 84 PID 3760 wrote to memory of 4532 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 84 PID 3760 wrote to memory of 4532 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 84 PID 3760 wrote to memory of 4708 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 86 PID 3760 wrote to memory of 4708 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 86 PID 3760 wrote to memory of 4708 3760 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 86 PID 4708 wrote to memory of 4616 4708 Logo1_.exe 87 PID 4708 wrote to memory of 4616 4708 Logo1_.exe 87 PID 4708 wrote to memory of 4616 4708 Logo1_.exe 87 PID 4616 wrote to memory of 4592 4616 net.exe 89 PID 4616 wrote to memory of 4592 4616 net.exe 89 PID 4616 wrote to memory of 4592 4616 net.exe 89 PID 4532 wrote to memory of 2196 4532 cmd.exe 90 PID 4532 wrote to memory of 2196 4532 cmd.exe 90 PID 4532 wrote to memory of 2196 4532 cmd.exe 90 PID 4708 wrote to memory of 4360 4708 Logo1_.exe 91 PID 4708 wrote to memory of 4360 4708 Logo1_.exe 91 PID 4708 wrote to memory of 4360 4708 Logo1_.exe 91 PID 4360 wrote to memory of 4664 4360 net.exe 93 PID 4360 wrote to memory of 4664 4360 net.exe 93 PID 4360 wrote to memory of 4664 4360 net.exe 93 PID 4708 wrote to memory of 3512 4708 Logo1_.exe 40 PID 4708 wrote to memory of 3512 4708 Logo1_.exe 40
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4520
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA9.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"4⤵
- Executes dropped EXE
PID:2196
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4592
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4664
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD520cef2186133a343a70d5d5d4feef3a3
SHA14844bc3596fa52272bb96cc418f2754b9e33fb17
SHA256a56a482a19e754be811a156bce1a2951aa5ce0765aca04261ede8179ad9e33db
SHA512023fb969db382c783bbcf9b6fa8e88603caeac25b7802da432a98a5d4a686893e97de785d918341767b389f39ebfaf5111b42fe283802402fe0fe04e1b2eac54
-
Filesize
577KB
MD5b698943451b4bbe37d8df2a597b4b70d
SHA1bdf9b7fb5e8e45e127a1f3a90a595ef986edaf56
SHA2567a022236fa929cbb877ca4c83411e76b86d0c2fe7ab9a0462835b7dbde009cd7
SHA512624f121d4b70ba590afb16a3015e89b2e5f62a991fc95dc3c844a513312a06683c761f38934cb2733ebdd9b3b8404f2ec3665dbd5528a0e0205b9806b133f819
-
Filesize
488KB
MD5ee67e995cc720bdea9ad5bd16b0ff7bf
SHA18779525e9576a51cd6441b6c35e5e38690c94f34
SHA256ef3bfd992ca033aacbe64d6a949a4dc94a3ee19fa7349298541faf08298b1d98
SHA512e1aebdd145ea7415867ff44e71a8e3f730f2c8712ca3c79289cc00231fbdb7b03c000d069ac60eb5cd62eff6079cf4fd4595a6016a4c98ea19051767366e4524
-
Filesize
721B
MD56533da746ac9de5cc70ad331c782e89b
SHA17d58585d163534c2378d11993850fce6fb3a55bc
SHA256ccd67625b2d2edebe2b23ba379153a4ca60344cbd141ea4bd20751e24ce27065
SHA512f5e15af833770bac5c584bd7a3a576ccca2e8af881b8a71c977a2d804c5f46ae63395dd520778e0dc4d6d23f2aed4edbe7e67e684181d277938224fc3c1b91da
-
C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe.exe
Filesize60KB
MD5ed0fde686788caec4f2cb1ec9c31680c
SHA181ae63b87eaa9fa5637835d2122c50953ae19d34
SHA256e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c
SHA512d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b
-
Filesize
33KB
MD574de944429af39f54ac31888ee07b892
SHA17c05f329379c5a396dbdf1e3857f59734eeaaf07
SHA25622a484df9625b0a17e2e7b65945360f0b031ec1bea68fb96d3553d07ab354f52
SHA512d4a8d643b207e1742071a11b05b3044c0750849f767ecbecb5e957d1df1bc95a312a0a595c7c34cc8a09523ef25deac47fddb4801735bcff6087879ef8d10fd7
-
Filesize
9B
MD562b5f4cbf35e0811170865d2c1b514b0
SHA1eb9ab8cea4d5052efe5126141140269f2fc29e7b
SHA2560c2b516efab7a741c31502cb6f7828de32cd4feb088b683d651225489f183bb3
SHA5124632536c26324e72b20e87d53546ea1d012bc1f3457ce5d8e1b33dd3eebc41ad5e4a3d3f6a3a542d7ce103f95ca5a5a1973c6c036980f1e8860c6c5d93c5696f