Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
General
-
Target
ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe
-
Size
393KB
-
MD5
b8464e043c9ba29f5b70fdaadf00922b
-
SHA1
828d5c2072b34fd1b9a5988a303f354474d6fc1c
-
SHA256
ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd
-
SHA512
1b0ae871b17fee5381a047eefbdac50437a57fda1de6ada6e76c8fe13ce316f2a77a61c5d3e40e99af8616afa5534f31ebd5b2341e1e30fdcfda944fc5dd279f
-
SSDEEP
6144:D+a0P2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1moHXG:D+aZahVy41
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4556 Logo1_.exe 4120 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Services\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe File created C:\Windows\Logo1_.exe ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4100 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 89 PID 4500 wrote to memory of 4100 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 89 PID 4500 wrote to memory of 4100 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 89 PID 4100 wrote to memory of 3152 4100 net.exe 91 PID 4100 wrote to memory of 3152 4100 net.exe 91 PID 4100 wrote to memory of 3152 4100 net.exe 91 PID 4500 wrote to memory of 4728 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 93 PID 4500 wrote to memory of 4728 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 93 PID 4500 wrote to memory of 4728 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 93 PID 4500 wrote to memory of 4556 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 95 PID 4500 wrote to memory of 4556 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 95 PID 4500 wrote to memory of 4556 4500 ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe 95 PID 4556 wrote to memory of 2876 4556 Logo1_.exe 96 PID 4556 wrote to memory of 2876 4556 Logo1_.exe 96 PID 4556 wrote to memory of 2876 4556 Logo1_.exe 96 PID 2876 wrote to memory of 1760 2876 net.exe 98 PID 2876 wrote to memory of 1760 2876 net.exe 98 PID 2876 wrote to memory of 1760 2876 net.exe 98 PID 4728 wrote to memory of 4120 4728 cmd.exe 99 PID 4728 wrote to memory of 4120 4728 cmd.exe 99 PID 4556 wrote to memory of 2768 4556 Logo1_.exe 100 PID 4556 wrote to memory of 2768 4556 Logo1_.exe 100 PID 4556 wrote to memory of 2768 4556 Logo1_.exe 100 PID 2768 wrote to memory of 2368 2768 net.exe 102 PID 2768 wrote to memory of 2368 2768 net.exe 102 PID 2768 wrote to memory of 2368 2768 net.exe 102 PID 4556 wrote to memory of 3548 4556 Logo1_.exe 56 PID 4556 wrote to memory of 3548 4556 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe"C:\Users\Admin\AppData\Local\Temp\ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BA8.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe"C:\Users\Admin\AppData\Local\Temp\ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe"4⤵
- Executes dropped EXE
PID:4120
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1760
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2368
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5f1ff0cfb99f6b0bf2a9e1de01f1ec6c2
SHA1487ec0860993efcb76858a15e85372df2987750d
SHA256bb358cb0d1d27f1977fc528b2706cc7dacebb059c6f13a894cf390aeeb2f72e0
SHA5124eb05b18d762707e7c7632dd7c9b1858d9498c36998d23fd2b71ee37a5f09d8641db6397aae98d9c55aa4a5ed03189fdfbae2b50095ae5ccd88f75c361d739b4
-
Filesize
577KB
MD515d25b3b67de24e76c378e5626b6f653
SHA13136830b143b37acf71d360b3cb0d9453ad74c37
SHA25604823ec5e49ff658303130cc666b6e5945b11dd45ca9d6722b6551ee7ad700fa
SHA5126fb72bc62cb5521dbea5adc6b65aad723539f91b097f140cceb6bfa411d2b7a0c49224f0d4406e48d88439258a9f30dfacff640ba61551182a8e859bba08da05
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD53cb4c47324c118a345b7c0674675d736
SHA1a24a927dae79e823df3d0dd6c2c466bf68166c1e
SHA256a9c3670846d466ffb24498376e95cf8661cf42765953e6d3bbb3d4b096c1d87e
SHA5121b65197f62207b5c0333133aec500e6b90d4e8f24f93287f70b89e45081e644b2582b014a0a55169bdd582fa3b35564504a92c658036e3f2e0a3cca98771d7c6
-
Filesize
722B
MD502aadb4511d8b3fb577adbf023fbdc1b
SHA10248d09e6f85dc836e7306a570c9730a7646ab7d
SHA25662e149d95d97285ce8398c94dc01ef7660a72c8e7ac644bd8b5f6c1687e8519e
SHA512e339d67baa794d009fb62b4b75bf80c0b0cb159d2bcdcf711e2d90b1e3bd75556fbbcc9eef77027de4babd79af0f4eb908b19d029f9407777c800603f75eff56
-
C:\Users\Admin\AppData\Local\Temp\ef3c3bc144e2b0a45b439fedd02afdef60163054a340492019cad2b5dccd4edd.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
33KB
MD502c56be1db3c03dbaf50330e686d3c74
SHA1c38374d6d8db6163f21b27fb353778f94e3cd1e9
SHA25698ce89e1c74b56f7336b4cfab30d0280e56f9dbef29a8c38ac7540e22df4b5b5
SHA512c4ee4590c268296541f3031b16570d9fdd3d6bd85fa3cc2c2a4f5594bfd4888eee7749d2eb3a44cafe38a9cfa777ee82b58d9d0bf5c7682c2f8d02bdbba54ef4
-
Filesize
9B
MD5a4e284afce5c2e93b509543e6064da82
SHA177a7ae3e38b05410dcf335f8abe1df4d7f0b141c
SHA256f4460d1a85b2980fa2b8d329adda0fd330f8157d7afc2d7b1bad62453ff1dfe8
SHA5128f2147ca54c96b0b05bf69a7919b5bf54b20036ba8336f6ba379c2abb0d31139a91d315130040ef1d06450dd624d8a8661396eb082407b8f7455be4d61351821