889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
Size

26KB
MD5

e3eb1871a00de661e94d2d4179c64daf
SHA1

65584609b0e91895e79896cf2bc314bb0793583a
SHA256

889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607
SHA512

dc1bcea3aa7cabee603ca13d540743e6d546f4e4c05047991bec1388c92769972203d107dd75abba96771b3bad45c788421d6b7346c5bdca4dee162cc49bd907
SSDEEP

768:sS71ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:safgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\X:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\W:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\U:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\S:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\J:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\V:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\P:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\O:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\N:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\K:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\H:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\T:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\G:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\E:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\Z:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\R:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\Q:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\M:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\L:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened (read-only)	\??\I:	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\sr-latn-cs\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2772	1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe	86
PID 1500 wrote to memory of 2772	1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe	86
PID 1500 wrote to memory of 2772	1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe	86
PID 2772 wrote to memory of 708	2772	net.exe	88
PID 2772 wrote to memory of 708	2772	net.exe	88
PID 2772 wrote to memory of 708	2772	net.exe	88
PID 1500 wrote to memory of 3384	1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe	56
PID 1500 wrote to memory of 3384	1500	889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe
  "C:\Users\Admin\AppData\Local\Temp\889117f4914c78ec54461c5be58a001c498928987300745eef213ebd1a892607.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
168681c876bdc301911ce24b47935282

SHA1
a8913de7eee059f1c465c56282ec2ef7a2abcc09

SHA256
41c1720cd5458ab7a50f91ab38e9a13bea2941eb09b9a248809f9fc4369976f9

SHA512
7fbb29dce92283c2d9a70f2915c6ce53c4e0668d33e0c4099d557c5ad345c186917e9459f05eb6b4b901f9bbf707f671e50f980991b39856d05d33b18aedcdcd

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
165KB

MD5
8805fb580e87a83e3679489929ea9233

SHA1
444e49496f508df549c501c45094120b5878751e

SHA256
1014e3b14f5517e4a846ec46565afb1c7fe676ea810f452dc7a2fe4dea1064ff

SHA512
ef6c86b459e790e91644f1727a5227cb7946ce3093b48a4433a59a4583ccf026b627d48732422b9d49c857659257759cf91ce0836b09a53fcc575e32e10bfc25

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-557049126-2506969350-2798870634-1000\_desktop.ini

Filesize
9B

MD5
cbff752523567179ac32a14f905e1944

SHA1
446aa136e2ec27c083df7dd49d0252f1c0243bde

SHA256
eb7756d2a0d4fe754f1fe3d1d30c92a3f7ac52252b13cd171fd7ce553d760371

SHA512
9131c53463d7ce35aa85fbd70b312fdbc04c7c649fae0f6a762758e8e39ee863bdf84a6d23d1879814f69a6d4c4fe38501235c2e557b68309d560f06c18e9eff

Download Submit
memory/1500-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-1161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-4726-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download