ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
Size

26KB
MD5

ce28bc74b11c64c15ce6c902cd3e2934
SHA1

0792880806d421d5f8a6616dde1f3082f0d986d5
SHA256

ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6
SHA512

8f58951780763af81ed542377fcbfea7066ae5ed9daa371352249d27b09d0360505462a5a7762f9bfc86c226efc0b44b26c5139a814c8e5a9e5b3ded68a6e747
SSDEEP

768:6Zr1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:yBfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\S:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\Q:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\L:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\P:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\O:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\J:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\Z:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\Y:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\X:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\V:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\H:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\E:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\W:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\R:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\N:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\M:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\U:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\K:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\I:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened (read-only)	\??\G:	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe\ro-RO\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\Uninstall Information\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\Windows Defender\ja-JP\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-black\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4000	2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe	89
PID 2004 wrote to memory of 4000	2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe	89
PID 2004 wrote to memory of 4000	2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe	89
PID 4000 wrote to memory of 4144	4000	net.exe	91
PID 4000 wrote to memory of 4144	4000	net.exe	91
PID 4000 wrote to memory of 4144	4000	net.exe	91
PID 2004 wrote to memory of 3452	2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe	57
PID 2004 wrote to memory of 3452	2004	ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe
  "C:\Users\Admin\AppData\Local\Temp\ce04ea8acb03d2da75d3e37dcbe158e24b083147ab0375ecb3a0f812564ffee6.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
f3992cf8aa16fa44016894c878b91c8b

SHA1
61d7920d823597e8e83817f46d00a3d5eef8bd0b

SHA256
cfe2a84f7810d27a4d5a69e1b42c3ddbfaf8b98f857b7c73e87e15739561174e

SHA512
4368cd43244475d4e5fed189725dce895985d04406b6dc962be5b43ecbd4145b065c9569a2eed889c62f8bd9d7ed10a8fa9f90b1da53919a266c14ba98ad4ca3

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
165KB

MD5
7390c2db1013ae44d3b8335dcee69d56

SHA1
cc9015f6c20b8dc47a497193ca0b9b4ae36bdf10

SHA256
1696f29e9e4fe07c75505b5928ebed89dd89e139ead59a329566832f2e852fbc

SHA512
ac0bd4333cec98b2dab43096993cbf3037e741d8d0d365b81180bdaf15bfa5b7034e4496a9609345fdc3026a2ef17e4d6e446f484ba2607e4898d5451fecb464

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe

Filesize
481KB

MD5
1db5b390daa2d070657fbdb4f5d2cc55

SHA1
77e633e49df484b827080753514cc376749b0ceb

SHA256
d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad

SHA512
68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\_desktop.ini

Filesize
9B

MD5
ac7ef6d7fcd23c228941057dc1a38427

SHA1
aec0bc6ea51cea8edb23dd9ea7be81f113f42493

SHA256
fd687092833ff2ed530a5ba6d4cebe3c1e5f6c318da1610320743cc7e073a740

SHA512
6cf8518e3448d5f19775ac462fab31aac662f0386ed2aeae85b2b5591ee3092f25527beb74592f1c1e4a20f6488277b429c9f46e783937c4bb9f7439ffb6c4f3

Download Submit
memory/2004-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-962-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-1161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-4726-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2004-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download