182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
Size

26KB
MD5

628f74c6973e9ef88b056d56d5ca3838
SHA1

fb57cf57ea208370151746240545cae600e9237e
SHA256

182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535
SHA512

e6f9f2b182774245ad628558351a07504a1562019412c0c310cf663878f51fc06cdaf3035b9c7f01bb62e9c2944e9e29bed6c15f6c105a7dd0ce5719d3265cc9
SSDEEP

768:+1ODKAaDMG8H92RwZNQSwz1/WRFcwujg0:YfgLdQAQfR/WRRuR

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\L:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\I:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\Z:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\Y:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\U:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\R:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\Q:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\P:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\O:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\N:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\J:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\X:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\V:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\T:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\S:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\M:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\K:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\H:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\G:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened (read-only)	\??\E:	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Windows Sidebar\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en-gb\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4860	1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe	86
PID 1908 wrote to memory of 4860	1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe	86
PID 1908 wrote to memory of 4860	1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe	86
PID 4860 wrote to memory of 2308	4860	net.exe	88
PID 4860 wrote to memory of 2308	4860	net.exe	88
PID 4860 wrote to memory of 2308	4860	net.exe	88
PID 1908 wrote to memory of 3504	1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe	57
PID 1908 wrote to memory of 3504	1908	182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3504
- C:\Users\Admin\AppData\Local\Temp\182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe
  "C:\Users\Admin\AppData\Local\Temp\182680cab1bf1b1159a30eb47cb6b5950afeea013630c5d948e02e7d71352535.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
165KB

MD5
2ac97f870c5f9ba4912ab3806347527a

SHA1
8a565f5779195793c1015447564dba406d8ac057

SHA256
67b98664e666ef2eda20191a40d1b215812993c93389b616302ff1f1409e2db5

SHA512
7baee55eb06d46242cfe52dea33618040c570d4316486409624352d890ec454f1814d28fdde5637a9dd268e1979d1dee03f2c0415dc3179fe71a01cc681c2db2

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe

Filesize
481KB

MD5
e0430136ac690c55c40bc04e308799a3

SHA1
1a7f9082c92875698e035bef255306ee9d35a8d6

SHA256
333c13871e60bec167c8cfd2655ad0d53388156f9dd34f49ab9504fa0fbcf10f

SHA512
c74d4cdfd99ae18689d47fd04689e5f489c6cfccae06e113e5f55f7e3dbef86fa0842d0cb60f6e7aac964f9b363c71c6141c625e8a7f8a1ecce898c979bde6f0

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\_desktop.ini

Filesize
9B

MD5
9d515d16952bdb1cf51672ad091046bc

SHA1
5fe954c6d41499122182eb48cf6f9d203b9eae7c

SHA256
12ddf5d72be26a3f4fb46d905661e24bf30948454c9701f20e50436a238a25db

SHA512
d0f7522406355a837e55f5a99b6969ed4b0ccbc2e427b83a917eedffc37899b139c2b33ea73a90469a6045b3b71848bf97641528644a4a3f55d666223fa31d4b

Download Submit
memory/1908-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-994-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-1161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-1633-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-4726-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download