7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260

Analysis

max time kernel
149s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
Size

39KB
MD5

0c66c78eb026971356126503c6366615
SHA1

0a6ff1ba641cbda042328329393fff95e356f94b
SHA256

7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260
SHA512

b5a781cf4eda3414c0c0ba6f1db084f5d19d7df625c587bef83867d1f6bec8a0e96789015acb15adc5b7572fcd203458a26d5a1a00aa6702fc77eb3b08f20495
SSDEEP

768:8bjeUHoO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:8mFe+Zk7VJbwlYXjPrsqrZMYR5p8w

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\Q:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\O:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\X:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\U:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\N:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\M:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\L:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\T:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\R:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\P:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\I:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\W:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\V:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\K:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\J:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\H:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\G:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\E:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\Z:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened (read-only)	\??\Y:	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\Internet Explorer\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\dotnet\shared\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
File created	C:\Windows\Dll.dll	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4740	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	84
PID 4500 wrote to memory of 4740	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	84
PID 4500 wrote to memory of 4740	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	84
PID 4740 wrote to memory of 880	4740	net.exe	86
PID 4740 wrote to memory of 880	4740	net.exe	86
PID 4740 wrote to memory of 880	4740	net.exe	86
PID 4500 wrote to memory of 368	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	91
PID 4500 wrote to memory of 368	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	91
PID 4500 wrote to memory of 368	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	91
PID 368 wrote to memory of 4320	368	net.exe	93
PID 368 wrote to memory of 4320	368	net.exe	93
PID 368 wrote to memory of 4320	368	net.exe	93
PID 4500 wrote to memory of 3496	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	56
PID 4500 wrote to memory of 3496	4500	7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3496
- C:\Users\Admin\AppData\Local\Temp\7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
  "C:\Users\Admin\AppData\Local\Temp\7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe"
  2⤵
  - Drops startup file
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:880
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
264KB

MD5
82aff40c160a0a881bf7a0fa4b647957

SHA1
dee101a59ad91bf0065dafb0fd680c339c110c17

SHA256
c0025a5dc9fd03e01f08941e4163078e5ce9adc3401c1e1da6441c27cdf0d0a3

SHA512
de32bf34a53fa0c80ba3b1277ff42f708fba5414f6d281baada7bf1268d4cebf09c3fca613b73962ba112c22ba6690689a0c2727d63e2a8adbe0868ba2ec6ce5

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
54KB

MD5
23e43de89c189055e59e2d0658af929b

SHA1
8e23046e9685433d372b5075940b532ab9a954c7

SHA256
52a3e30c60b647f56a62f8e2a614969aba7c14077a09e81bcda4e4fdb0bd8152

SHA512
71ae2b26857f8db6d9986f3231ebb790307296bb625446ca05103a30a054683e8f117344b528d7ebddbb12aa133e48857403347b938cc3793659117e732b3628

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
649KB

MD5
e4b4c486987a76abb8a18c33b36514b5

SHA1
1c83216295cfc852c1a35198e31d8d385efd373a

SHA256
30f0474b455caa56bfb989bfcc04bb4db00f81857c28657f3fecf1dbcc6eb5dc

SHA512
f8532180a32b17153626d9879a93159132b2e10708e81aec83c995a8e9b642d5b6ccdd1db676c92302bdd5bb97726e670876490e97d65b27865ea7e72c8c4515

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2288054676-1871194608-3559553667-1000\_desktop.ini

Filesize
9B

MD5
c59aab012a570d8b20f60efcafb272be

SHA1
709df64d9a23340c6bc42f2bf8dfdca512bff2e0

SHA256
8a349242c7461f8fccc029421cd051ef8f140a8e3738d348a2354a3d5b9de220

SHA512
8c3f67dc02beaca59f0deaa4d8e33bc385b19df02d2a8b905b47148e21919f7d059f3883f02dad25a0d11dc807343390114753a7918171720d8cd72e84239e17

Download Submit
memory/4500-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4500-3-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4500-3915-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4500-8697-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download