Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe
Resource
win10v2004-20231215-en
General
-
Target
d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe
-
Size
29KB
-
MD5
5e89dcb94742ed6215c602c94b743e50
-
SHA1
0699c02b02d583ae5292a68e0ade2ca27992e1f1
-
SHA256
d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe
-
SHA512
84e8e5645828712fe3e372e1bcdb9453133873b487cc2088d3b8562f948061a041bbe22f93361b62d30ae55cbaf955cef7dc36978eb59c7cbdde2f86f8ce31ad
-
SSDEEP
384:NbbT2wuPW1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pAPW16GVRu1yK9fMnJG2V9dHS8
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\K: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\Z: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\V: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\S: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\R: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\P: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\I: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\X: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\U: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\Y: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\T: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\Q: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\O: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\N: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\M: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\L: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\J: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\H: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\G: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened (read-only) \??\E: d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\messaging\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\View3d\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\_desktop.ini d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1212 wrote to memory of 3648 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 84 PID 1212 wrote to memory of 3648 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 84 PID 1212 wrote to memory of 3648 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 84 PID 3648 wrote to memory of 4916 3648 net.exe 86 PID 3648 wrote to memory of 4916 3648 net.exe 86 PID 3648 wrote to memory of 4916 3648 net.exe 86 PID 1212 wrote to memory of 3432 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 57 PID 1212 wrote to memory of 3432 1212 d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe"C:\Users\Admin\AppData\Local\Temp\d1dac160c031e0cc6a9503e1e0b4a36571e0293ba050f5a9c859ece04896dffe.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4916
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5d20a8f02fb08eecf5f0eb07335b3422d
SHA1dcdd5d2f82c7870591425528b78634e08eb34ca9
SHA256c33037d6b0e39147d1383fd9a5c2763c6dadaf47f90bc325736f9f382b408d2f
SHA512602c3c440e594e8893c94e55c4975a1287d48ebe08e22cbf8483d23de7c83b6c3908fae7214f7b42e32354d24aaffb9311804bfb792e0d8d706b10973ecbd534
-
Filesize
168KB
MD5899bcb3ed62e158144c97e6370699e6d
SHA180c35a34acc45d110839ce480ed466259b50f67e
SHA256c7d868d441b98cbacd1fd6eba3a56c76e2d3cbfd7139f6fb11564ad6b6c441d1
SHA512511b2479914ffe487ea34d2b39552c5d87be78f7c31a7ab638de9e886135e1f04b6b2da13db4c0faa655383756254a12d066c62ccc4d41506c32e61d845a1578
-
Filesize
484KB
MD5a18a138107cc6dfd869fb58fad8b080d
SHA1e9153e35ed7ff73a9450775f93cbc5b69d17f129
SHA256907520b96672f6bc5f1dff8b7b0bf8efc7f5c439dfbf0ed4d3f85b1e7d15ceb3
SHA512016adf8fcd24de11c7f1e4516feccaf05fa6f283607e36727327f74183660aa35afab558d155e045b41ca8eabbd18ac98355e59ef0b14420eac78941841b7503
-
Filesize
9B
MD59d515d16952bdb1cf51672ad091046bc
SHA15fe954c6d41499122182eb48cf6f9d203b9eae7c
SHA25612ddf5d72be26a3f4fb46d905661e24bf30948454c9701f20e50436a238a25db
SHA512d0f7522406355a837e55f5a99b6969ed4b0ccbc2e427b83a917eedffc37899b139c2b33ea73a90469a6045b3b71848bf97641528644a4a3f55d666223fa31d4b