Analysis
- max time kernel
150s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
07/04/2024, 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe
- Size 33KB
- Sample240407-ypys7ada3x
- SHA256 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35
- MD5 b59d8960d516dd1c8af90e16e9b32606
- SHA1 324f6305151e613b528ec016c57d4fb17d6c2743
- SHA512 07d576132e937b630b066b16b45ae4ebe7b4b7c941b774c61423a32d03a8e11709929f1b837ef08378e1502deed0abeb49e6523f728a32f303ae8976d61a6b78
- SSDEEP 768:AZZZZZZZZZZZZZZHO5RroZJ767395uINH2iTQKvFrQ2XKxgkQe:ADe+Zk77RNH2iT919XKKkQe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\L: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\G: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\N: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\K: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\E: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\Y: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\V: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\Q: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\O: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\M: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\J: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\H: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\Z: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\U: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\R: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\S: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\I: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\X: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\W: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened (read-only) \??\T: 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Mail\wabmig.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Microsoft Office\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\de-DE\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Java\jre7\bin\server\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\VideoLAN\VLC\skins\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe File created C:\Windows\Dll.dll 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2372 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 28 PID 1044 wrote to memory of 2372 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 28 PID 1044 wrote to memory of 2372 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 28 PID 1044 wrote to memory of 2372 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 28 PID 2372 wrote to memory of 2608 2372 net.exe 30 PID 2372 wrote to memory of 2608 2372 net.exe 30 PID 2372 wrote to memory of 2608 2372 net.exe 30 PID 2372 wrote to memory of 2608 2372 net.exe 30 PID 1044 wrote to memory of 1200 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 31 PID 1044 wrote to memory of 1200 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 31 PID 1044 wrote to memory of 1200 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 31 PID 1044 wrote to memory of 1200 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 31 PID 1200 wrote to memory of 2624 1200 net.exe 33 PID 1200 wrote to memory of 2624 1200 net.exe 33 PID 1200 wrote to memory of 2624 1200 net.exe 33 PID 1200 wrote to memory of 2624 1200 net.exe 33 PID 1044 wrote to memory of 1204 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 21 PID 1044 wrote to memory of 1204 1044 1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe"C:\Users\Admin\AppData\Local\Temp\1999e484b85a43254eb5c7ce1a8e0a8bbaf27502c55613df58f7f48b4f41ab35.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2608
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2624
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 1ea60a85ed4901ceb24b582d53251a8a4565fe7baa5fa3b61bdbdd8152bd93bf
- MD5 283f68a6ebd27193167b0d393e0854c1
- SHA1 69e7e2be3615cda7f36ea083f8a0ab7bee51bdbf
- SHA512 2ab41536a69db38af5ec16f82bf633eec88797733654bdee5c3ec098839806106934e67f9390c1c4b5702094ae7ba6adf32896a4c7d4d095c3b2d2c8559d6350
- SSDEEP 6144:5+aX3rX1pgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:5+arFWitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 717KB
- SHA256 dae65a4be9e5c6e874a11208bf59de285f314beb0d1e5097192fa768ddeb085b
- MD5 a54a6af3da296876302cc37eb781bad5
- SHA1 5176268af0a0acf3108cf41ada70051115ab073d
- SHA512 f8edceab7769f98d540466ab6beaa136ae15f976960eb5166c4c18da568128761b9de915f978ad31b935b12fb9434222102a013ccaa0851b11262cefa1a95f5a
- SSDEEP 12288:3+arFpfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:3BrDLOS2opPIXV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
- Size 478KB
- SHA256 65f0e48a590681fd14bf38dbbf806d91d1c8db9c6a90399e7082c4073472d206
- MD5 1e8cb3f8c1780c774b7d6fc122826f12
- SHA1 475708a1f29a9529d3d471a2cea5c64513ab4128
- SHA512 fe2689bbf2605cc654553e8ea014cb415bed633958011742c326edfb9bf8aaeb8d72ed0ccc28f27ed470307e11ed2c2149f662dbc54d415657a2a2dd179cb139
- SSDEEP 12288:52+arFWZc0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVzy:cBrcMYenGJiKEbXWtfOkUy
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\_desktop.ini
- Size 8B
- SHA256 2d3dbb80989e5cc7ef9ef800cc986bb8dccf4ca1f78437040bccd59312a55593
- MD5 331b730a7f1adbf1f0bc05e0c610f0f1
- SHA1 2f2283f84f040fbd4ecf99055026b70bb3b732ec
- SHA512 16790117c382e66c8af2932ed0c37229ae5ee6b8bbaa8bd4e3f9afed6e07cd89c5807c81145f19f561ab714d844826cf6099a6dc97d84fa3f9da5e763bcc78c4
- MD5 SHA1 SHA512