Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 21:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
-
Target
b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
-
Size
577KB
-
MD5
78e854681e1d3a897c7e1a32d8154138
-
SHA1
8c86c373573f432e25b80870cb36dbddfee8fd22
-
SHA256
b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5
-
SHA512
0fbb1bea1de300ff06b3a7ddc2bbdcc1f000e2641ef79fa48e7158f10db961cb3d1731265fd3a11b6ef12ebbb34af344c32404b38b84227a881e1db734cd9bbd
-
SSDEEP
6144:MG5KQE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:MPr7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4288 Logo1_.exe 3804 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe File created C:\Windows\Logo1_.exe b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe 4288 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4160 wrote to memory of 824 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 84 PID 4160 wrote to memory of 824 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 84 PID 4160 wrote to memory of 824 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 84 PID 824 wrote to memory of 2444 824 net.exe 86 PID 824 wrote to memory of 2444 824 net.exe 86 PID 824 wrote to memory of 2444 824 net.exe 86 PID 4160 wrote to memory of 2496 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 90 PID 4160 wrote to memory of 2496 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 90 PID 4160 wrote to memory of 2496 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 90 PID 4160 wrote to memory of 4288 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 92 PID 4160 wrote to memory of 4288 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 92 PID 4160 wrote to memory of 4288 4160 b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe 92 PID 4288 wrote to memory of 2740 4288 Logo1_.exe 93 PID 4288 wrote to memory of 2740 4288 Logo1_.exe 93 PID 4288 wrote to memory of 2740 4288 Logo1_.exe 93 PID 2740 wrote to memory of 3292 2740 net.exe 95 PID 2740 wrote to memory of 3292 2740 net.exe 95 PID 2740 wrote to memory of 3292 2740 net.exe 95 PID 2496 wrote to memory of 3804 2496 cmd.exe 96 PID 2496 wrote to memory of 3804 2496 cmd.exe 96 PID 4288 wrote to memory of 3396 4288 Logo1_.exe 97 PID 4288 wrote to memory of 3396 4288 Logo1_.exe 97 PID 4288 wrote to memory of 3396 4288 Logo1_.exe 97 PID 3396 wrote to memory of 3620 3396 net.exe 99 PID 3396 wrote to memory of 3620 3396 net.exe 99 PID 3396 wrote to memory of 3620 3396 net.exe 99 PID 4288 wrote to memory of 3468 4288 Logo1_.exe 57 PID 4288 wrote to memory of 3468 4288 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe"C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8750.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe"C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe"4⤵
- Executes dropped EXE
PID:3804
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3292
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3620
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5616f8c1916ec81484c8aefe8899f7c35
SHA14e5fc08bd9b2994582dd4f7fc33f544a89bc5fd5
SHA256d00dd083b9e7d238419f3f6d4c9c67489b752d8a44911a7ab4d8e9758ca63919
SHA512f2fc79f30a6eb798d2b8916341014849cf2375d011b14577ef40f13906f44c1bf512203979b3ca8ac544e84e503d2cce93b0c4408f50b05a862996dd49d90fca
-
Filesize
577KB
MD578e854681e1d3a897c7e1a32d8154138
SHA18c86c373573f432e25b80870cb36dbddfee8fd22
SHA256b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5
SHA5120fbb1bea1de300ff06b3a7ddc2bbdcc1f000e2641ef79fa48e7158f10db961cb3d1731265fd3a11b6ef12ebbb34af344c32404b38b84227a881e1db734cd9bbd
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5f9bda517f882e3c2636d44cfa30c8ef0
SHA106822afcd175307e76db635fa14c80b4708458ba
SHA256cb3149e29fc3c22b6ed7a427146780eb251e10b54153139535f6999b33037de8
SHA512e6c867020f86944f79cb768de9a01c60c36bbbf2937cf8cecb096ad578d06a2a37a3976665f2063da1e3e3be62ff26b520abe26d442e084e0b496d5ab08e1050
-
Filesize
722B
MD5a02a8592ba4565f8e9372d2e19a99fa4
SHA14f1fff0c8e57165f6c32a7b979bad3092cbb809b
SHA2561bc476ee476b00a234f675633d6f6aac72fed2464656db9f99dc6736f924a3ca
SHA51289ec79b8355750adee562c7a2866373c92180535b446eb63ce0dac7db855515b098b0daed26b976e05d496ad43e47cfda0fc262f140d8f11f73291ea701864e2
-
C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
33KB
MD55f4b64deb280c001783cf744b06bef33
SHA1e3962fe8ed4214be0cf4605b5ec6114320949eed
SHA25653f7b777df32f27c60853a9b5d65a8e6f99cddd820daaead05f938239d6bdb35
SHA512ad10ff2e3837acc133e0945e58f1fd3748242506d47694ad4efed6ac22325c7383ced5bc57dec390b3fd09952f5ffaef6946982972d67a969f333573492ed3cd
-
Filesize
9B
MD5137c71ab33d39f41d1d0f506748620c6
SHA1615708c800cedc2541589174e6e677e1563367b5
SHA256f1a3a71540f6e454bf800af51e8e8085c233f7281852519bd8b0ae36071f13e0
SHA512cb8e0ffac4c5606dec5cc9ccdb6ac981ed120efc64a4f4750ac59149280da5fb379c2af737bde3d9e23ca21c3ee3fa9e6c252dee9ef22102886e2390c9d504fc