Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 16:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe
-
Size
48KB
-
MD5
01b6d7a32917e448f5030b937210f372
-
SHA1
9f4645587abb30bbec12f2824ccb3859ecbd852c
-
SHA256
577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8
-
SHA512
06b188acd7da4d1af68bfb363f3af32d9c09741b5a2cf0cec1c9fdcd22b698073098e0cd3495b63dfb3616022a1a44513d49f8919b224b4122765dd3558a720d
-
SSDEEP
1536:2dKFaYzMXqtGNttyeiZnZLYm1pHqaNrFd:2kFaY46tGNttyeQLYm1gaNpd
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2008 Logo1_.exe 2096 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe 2008 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1948 wrote to memory of 4720 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 88 PID 1948 wrote to memory of 4720 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 88 PID 1948 wrote to memory of 4720 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 88 PID 4720 wrote to memory of 3360 4720 net.exe 90 PID 4720 wrote to memory of 3360 4720 net.exe 90 PID 4720 wrote to memory of 3360 4720 net.exe 90 PID 1948 wrote to memory of 2812 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 93 PID 1948 wrote to memory of 2812 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 93 PID 1948 wrote to memory of 2812 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 93 PID 1948 wrote to memory of 2008 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 94 PID 1948 wrote to memory of 2008 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 94 PID 1948 wrote to memory of 2008 1948 577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe 94 PID 2008 wrote to memory of 2136 2008 Logo1_.exe 96 PID 2008 wrote to memory of 2136 2008 Logo1_.exe 96 PID 2008 wrote to memory of 2136 2008 Logo1_.exe 96 PID 2136 wrote to memory of 1104 2136 net.exe 98 PID 2136 wrote to memory of 1104 2136 net.exe 98 PID 2136 wrote to memory of 1104 2136 net.exe 98 PID 2812 wrote to memory of 2096 2812 cmd.exe 99 PID 2812 wrote to memory of 2096 2812 cmd.exe 99 PID 2812 wrote to memory of 2096 2812 cmd.exe 99 PID 2008 wrote to memory of 2356 2008 Logo1_.exe 101 PID 2008 wrote to memory of 2356 2008 Logo1_.exe 101 PID 2008 wrote to memory of 2356 2008 Logo1_.exe 101 PID 2356 wrote to memory of 1720 2356 net.exe 103 PID 2356 wrote to memory of 1720 2356 net.exe 103 PID 2356 wrote to memory of 1720 2356 net.exe 103 PID 2008 wrote to memory of 3424 2008 Logo1_.exe 56 PID 2008 wrote to memory of 3424 2008 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe"C:\Users\Admin\AppData\Local\Temp\577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DB2.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe"C:\Users\Admin\AppData\Local\Temp\577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe"4⤵
- Executes dropped EXE
PID:2096
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1104
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1720
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD551ed9ab4efc7af69072f0b0cb33c7d4a
SHA1bf7c12afe6f8eb95355d92485debb16a073f8aab
SHA256532277e916d51a2e40e8f87b54298b6353873329b42e2d944c47457b1c415df0
SHA51201973dcd43cd0f1c1765db75c7c6ea533e2bf47bae1001f43b3f5fb46f6f3d80af6e299d082e46e753c237cd5961d8e67a11f1c056768db75e4c3106c20fe4fc
-
Filesize
577KB
MD5cbb1f86115a657aa6b80cc9b5eca89a2
SHA11664d7aa6421dc55ac22747179a7c919eb02091e
SHA256fc1aba78b4544f8c4ef2e02106884e526b7aa33f7c1794c256f6f3a8c1fa2576
SHA51209e91e10c6e4256ac7b830c4feb0e5b1a48dc1e455c3cee4fd6d6ed1a30d2d650fb5c0875064e986ac7b6d9b3b0fadbbde4549a99fc2b69efd48cbf41b269041
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD551c1eb02821359551eae62ff451ccbb4
SHA1917e11eb8a26a033a330a9cee5c5207d0da1109a
SHA2569afbb3fd781ea931d8bc856c768fe7af7e440e9f7a29950b5dca44593f0ef04f
SHA512062f0c32d3d9b46fc670512a818c88919bcc90a2f7f5bd4910f917a96c42527fd6c28117c366cb66cd6bfa3ec64f5a43aadcaa4bdad01c8d45eb2bfe2c85f5ee
-
Filesize
722B
MD51e9b8b34f282fd4eebf5eb7f36611879
SHA185760c9c0bea8bb985573b9d41f2989862fb31a4
SHA256acf5f73a3b68b64c9a3849d19654870232a1c963f0acff61606b5ef3d92e2657
SHA512b443908da2836bdb3562a6e48bf5c48aeb34706a2d1ed4e8fec6966801edb2dc3ec68cab3f7a93f507f3a5f84a6c869325dfbf7440286c43705c0c33055b9bdb
-
C:\Users\Admin\AppData\Local\Temp\577d279233966a02e9138dca03af6f91490609153583d16286f4d1bcc9b4dbb8.exe.exe
Filesize14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
Filesize
33KB
MD5190cfb52ec885264fac6f6fa82efa51e
SHA1a2557e755b37d73f39dc8de59ca7ae37e9e7efee
SHA256e8c435b1a8b093137bc740c8dbf3cf4c7e2e647d7d5d5b7637700349c74bfc09
SHA512df39c740cb59f101d20f6e6b1e50e74345d68a5bc1afe6cb1ff2951559fae570e1ee0926862c8eaf91f92f5e3c32179b19760942c1a39f3df20e9778745f8b8c
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD55e45e0c42537212b4bfef35112ec91ba
SHA110c59c091fd35facc82bbc96938f118ce5a60546
SHA2569f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5
SHA512ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb