da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
Size

26KB
MD5

bfeab0388750a5a79c7ff69ecbc7d620
SHA1

a9582b3bc470f62acf7b8d72cde0db3f3d58bc3f
SHA256

da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581
SHA512

06f4b3c522c1ef5e748219e058a92287819bb81a1aecdd1ea2b226cfb3ae843218b0e3ef322c4287ea9f9d52c908d6e30a4d9fae7b74f29201bd1b088066368a
SSDEEP

768:cf1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1:cNfgLdQAQfhJIJ0IO61

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\Z:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\V:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\Q:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\P:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\N:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\I:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\W:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\O:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\K:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\L:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\J:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\G:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\M:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\H:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\Y:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\X:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\U:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\T:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\S:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened (read-only)	\??\R:	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\View3d\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 428	1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe	84
PID 1268 wrote to memory of 428	1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe	84
PID 1268 wrote to memory of 428	1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe	84
PID 428 wrote to memory of 2172	428	net.exe	86
PID 428 wrote to memory of 2172	428	net.exe	86
PID 428 wrote to memory of 2172	428	net.exe	86
PID 1268 wrote to memory of 3544	1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe	56
PID 1268 wrote to memory of 3544	1268	da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3544
- C:\Users\Admin\AppData\Local\Temp\da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe
  "C:\Users\Admin\AppData\Local\Temp\da0ae4d1ab1372cf32a678a91839f8cb2886032875aacfd53e88cf51edbc7581.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
918b4736f29e512ac304358c9c67e077

SHA1
56bcafaef7aadca5c5c0d90a4dc889f2e1455d70

SHA256
cad79fda8d13120763615b2032a8c60b5bf15dd9c28281cb2061bc2c16778833

SHA512
3af211976d66dd9939b1c3c4db88462c33d3d764788cbe3f27bc2df738ee47573e67781478e3beb704e11a74c4067af2c7214511f3ed89637a819a4dccae901e

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
170KB

MD5
c539a3758e0e58e0f181cac5627e828d

SHA1
309363f9236caa28b003a83530aad72fd49d3c49

SHA256
ccf8d4e5a3959ecc71862df08dab11e660ccc0e6057dc3492efe06d53baf7cd4

SHA512
00cafdbe0656fae486164863c5af2b16cc884d3c19f92b5095f6d0759946e4888d03af98b62183a3a41a5efb62ce2e416f4d01c06452e01a214de7dce4f2d76d

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
d82ffc872aed7c85cf936dcdcc2e6372

SHA1
50ca56cb4a429ce1532afaa2732f61833fc2b54f

SHA256
a487733710d946abff1a93a23ae6bbafd6c0800bc78e4d5e3cac36e2a14ddace

SHA512
0b0031418275c6be01f7757111058cd5bd3e5f4862e0631e2e28c5e7ffbb271446abdc2a88a7953ae55112799bc4a051becc2b14491e0d1760e336498665cc8b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1268-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-1213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-4778-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1268-5217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download