24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
Size

33KB
MD5

c858f0eab2f675f1e7c938ea773f32bb
SHA1

e6e884e8ad8929583c883a1c1cc8db7e63ef9ad5
SHA256

24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6
SHA512

f203556e227621fe0c1d698ac16b187334c7bd088205569fbd22f899779a7a4899f7464345476fc0ad2930376267e67dbf97266ace93ab98295dc340291d99da
SSDEEP

768:2VKFElOIEvzMXqtwp/lttaL7HP4EUi91acSWGoYoLVCm1:2VKFaYzMXqtGNttyeiZnZLYm1

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\Q:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\P:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\O:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\N:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\L:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\J:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\H:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\E:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\Z:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\X:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\U:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\S:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\R:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\K:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\G:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\W:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\V:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\T:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\M:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened (read-only)	\??\I:	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Windows Mail\es-ES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Microsoft Games\More Games\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Windows Mail\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\_desktop.ini	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
File created	C:\Windows\Dll.dll	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3020	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	28
PID 2140 wrote to memory of 3020	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	28
PID 2140 wrote to memory of 3020	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	28
PID 2140 wrote to memory of 3020	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	28
PID 3020 wrote to memory of 476	3020	net.exe	30
PID 3020 wrote to memory of 476	3020	net.exe	30
PID 3020 wrote to memory of 476	3020	net.exe	30
PID 3020 wrote to memory of 476	3020	net.exe	30
PID 2140 wrote to memory of 2716	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	31
PID 2140 wrote to memory of 2716	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	31
PID 2140 wrote to memory of 2716	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	31
PID 2140 wrote to memory of 2716	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	31
PID 2716 wrote to memory of 1028	2716	net.exe	33
PID 2716 wrote to memory of 1028	2716	net.exe	33
PID 2716 wrote to memory of 1028	2716	net.exe	33
PID 2716 wrote to memory of 1028	2716	net.exe	33
PID 2140 wrote to memory of 1208	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	21
PID 2140 wrote to memory of 1208	2140	24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe
  "C:\Users\Admin\AppData\Local\Temp\24a01efed50697d395310831f77f6c0643a7cb77a00a5584fc4dd6510a0c91f6.exe"
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:476
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
f42b2bd96566176cb90f1a3446039f70

SHA1
34a0b9eb408a7dc831569b645f2b07516ff6efb8

SHA256
4da68eb90045c2520ff8215f3b029a2eb3416e9cab1a17ee884f7c310a70c013

SHA512
113152f24627f467e0f87cf2db74040ccdbbd248ba475734f826a63d28859b07d9d5a2ce5dec54a482a36eb7eb5e28e9713522aca289bf5b3084eed2abdc2d48

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
717KB

MD5
53713b81704bdedd352696ac3dca7062

SHA1
e1fe77f5d9dc37e6bc6172ff0edd70e71b68db27

SHA256
3e8704a8104bae171d02b949d6c98e81d7205109b25ae2ef96282b0cf2bd9377

SHA512
35d5f67b7de4858b852d17bc0ad4081383b0c45a87250fcc3cdf1459debccebafb7138eab3e96f58ed5f5601f0b1e97127f535bb048f44fef3d9511d26c7914b

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
0a2f7bc5d2f3b1abbf852f12ac72d39f

SHA1
3ed5d15e03f4a79247638844b8e938794445bfde

SHA256
c2eadf7bc1b2c55782d5307c4bfdc59f4c900494b9a624e199c675b582a13d7c

SHA512
8c47195b5c79359b6e7c5088d1a2c757ce6a1f16dd61c4c4d0bb7baafba4135c7a64541ce7a3af55b65f83af3df2677ff6f63f9c80fdfb1f7696d54c4609d63d

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
5e45e0c42537212b4bfef35112ec91ba

SHA1
10c59c091fd35facc82bbc96938f118ce5a60546

SHA256
9f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5

SHA512
ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb

Download Submit
memory/1208-5-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/2140-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2140-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2140-1773-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2140-4016-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download