Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
Resource
win7-20240221-en
General
-
Target
7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe
-
Size
39KB
-
MD5
0c66c78eb026971356126503c6366615
-
SHA1
0a6ff1ba641cbda042328329393fff95e356f94b
-
SHA256
7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260
-
SHA512
b5a781cf4eda3414c0c0ba6f1db084f5d19d7df625c587bef83867d1f6bec8a0e96789015acb15adc5b7572fcd203458a26d5a1a00aa6702fc77eb3b08f20495
-
SSDEEP
768:8bjeUHoO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:8mFe+Zk7VJbwlYXjPrsqrZMYR5p8w
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\Q: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\O: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\X: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\U: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\N: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\M: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\L: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\T: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\R: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\P: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\I: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\W: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\V: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\K: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\J: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\H: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\G: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\E: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\Z: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened (read-only) \??\Y: 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\Internet Explorer\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\dotnet\shared\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe File created C:\Windows\Dll.dll 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4740 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 84 PID 4500 wrote to memory of 4740 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 84 PID 4500 wrote to memory of 4740 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 84 PID 4740 wrote to memory of 880 4740 net.exe 86 PID 4740 wrote to memory of 880 4740 net.exe 86 PID 4740 wrote to memory of 880 4740 net.exe 86 PID 4500 wrote to memory of 368 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 91 PID 4500 wrote to memory of 368 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 91 PID 4500 wrote to memory of 368 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 91 PID 368 wrote to memory of 4320 368 net.exe 93 PID 368 wrote to memory of 4320 368 net.exe 93 PID 368 wrote to memory of 4320 368 net.exe 93 PID 4500 wrote to memory of 3496 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 56 PID 4500 wrote to memory of 3496 4500 7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe"C:\Users\Admin\AppData\Local\Temp\7db6e7b89825e97a70ffddd87caf6a9b6296134a89388986ea4867359903f260.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:880
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4320
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD582aff40c160a0a881bf7a0fa4b647957
SHA1dee101a59ad91bf0065dafb0fd680c339c110c17
SHA256c0025a5dc9fd03e01f08941e4163078e5ce9adc3401c1e1da6441c27cdf0d0a3
SHA512de32bf34a53fa0c80ba3b1277ff42f708fba5414f6d281baada7bf1268d4cebf09c3fca613b73962ba112c22ba6690689a0c2727d63e2a8adbe0868ba2ec6ce5
-
Filesize
54KB
MD523e43de89c189055e59e2d0658af929b
SHA18e23046e9685433d372b5075940b532ab9a954c7
SHA25652a3e30c60b647f56a62f8e2a614969aba7c14077a09e81bcda4e4fdb0bd8152
SHA51271ae2b26857f8db6d9986f3231ebb790307296bb625446ca05103a30a054683e8f117344b528d7ebddbb12aa133e48857403347b938cc3793659117e732b3628
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD5e4b4c486987a76abb8a18c33b36514b5
SHA11c83216295cfc852c1a35198e31d8d385efd373a
SHA25630f0474b455caa56bfb989bfcc04bb4db00f81857c28657f3fecf1dbcc6eb5dc
SHA512f8532180a32b17153626d9879a93159132b2e10708e81aec83c995a8e9b642d5b6ccdd1db676c92302bdd5bb97726e670876490e97d65b27865ea7e72c8c4515
-
Filesize
9B
MD5c59aab012a570d8b20f60efcafb272be
SHA1709df64d9a23340c6bc42f2bf8dfdca512bff2e0
SHA2568a349242c7461f8fccc029421cd051ef8f140a8e3738d348a2354a3d5b9de220
SHA5128c3f67dc02beaca59f0deaa4d8e33bc385b19df02d2a8b905b47148e21919f7d059f3883f02dad25a0d11dc807343390114753a7918171720d8cd72e84239e17