Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
General
-
Target
4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe
-
Size
169KB
-
MD5
d87d6facaf717caddf9e05d153ba3c92
-
SHA1
52a6c747fd184bb09b2a76e534555173d3127ce9
-
SHA256
4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8
-
SHA512
e5bcd1335967f0f6d2454c24619d1c8119a17b584340829925cc2ea5f239c1c0b8741729b422e23fa1ab49e4952911ab56786f7743a41d063f3d063ec7edc6ed
-
SSDEEP
3072:8GYe+azbRPrlr9RXFcQekqnwLD9m0WjfuRRfEdj4E3f90bC:td+azbRZvSQek9if1Vv+W
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4940 Logo1_.exe 3660 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe File created C:\Windows\Logo1_.exe 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe 4940 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 228 wrote to memory of 4492 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 92 PID 228 wrote to memory of 4492 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 92 PID 228 wrote to memory of 4492 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 92 PID 4492 wrote to memory of 3272 4492 net.exe 94 PID 4492 wrote to memory of 3272 4492 net.exe 94 PID 4492 wrote to memory of 3272 4492 net.exe 94 PID 228 wrote to memory of 1796 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 95 PID 228 wrote to memory of 1796 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 95 PID 228 wrote to memory of 1796 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 95 PID 228 wrote to memory of 4940 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 97 PID 228 wrote to memory of 4940 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 97 PID 228 wrote to memory of 4940 228 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 97 PID 4940 wrote to memory of 1548 4940 Logo1_.exe 98 PID 4940 wrote to memory of 1548 4940 Logo1_.exe 98 PID 4940 wrote to memory of 1548 4940 Logo1_.exe 98 PID 1548 wrote to memory of 2932 1548 net.exe 100 PID 1548 wrote to memory of 2932 1548 net.exe 100 PID 1548 wrote to memory of 2932 1548 net.exe 100 PID 1796 wrote to memory of 3660 1796 cmd.exe 101 PID 1796 wrote to memory of 3660 1796 cmd.exe 101 PID 1796 wrote to memory of 3660 1796 cmd.exe 101 PID 4940 wrote to memory of 456 4940 Logo1_.exe 102 PID 4940 wrote to memory of 456 4940 Logo1_.exe 102 PID 4940 wrote to memory of 456 4940 Logo1_.exe 102 PID 456 wrote to memory of 3596 456 net.exe 104 PID 456 wrote to memory of 3596 456 net.exe 104 PID 456 wrote to memory of 3596 456 net.exe 104 PID 4940 wrote to memory of 3240 4940 Logo1_.exe 56 PID 4940 wrote to memory of 3240 4940 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF5.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"4⤵
- Executes dropped EXE
PID:3660
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2932
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3596
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5ab6e14fd3b3b82a74d70dd03d0a8e116
SHA1e8263c09ed7968ab04e1459ad46041ccdd9ff5e9
SHA25603dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571
SHA512851e9288ba102d5eabd34d887b70a883307bce31ccb4c7eeaf2b3010cb6bb9435a9c0261bfdafb4a0bf4046b6bc7928cbfb62599269a9c197ec2f83efaf258e8
-
Filesize
583KB
MD5612c71f176cbb3a987994ef9d580f372
SHA1ab77fb255f0b3da4d50e3cdbf649c87188373a62
SHA2566ad09d061abc19754e50e37200a4c935dda0d4a33b03f4ff9c16bf58bf8f1be2
SHA51257a5d59e2b2892b17d769053ffc44957b7a119c43bab4528f9ea744b7df146dd0db25c82420e97515811c8a3e0dd8b6caf90b100a3a3dc2fb0fb0fe42cadbd9e
-
Filesize
721B
MD5a37443db62ea7f85c6a6550d5b6769f4
SHA1e473985e95049a2049cd4c6721435ab95559e4cb
SHA256d53ef7886f75b97c2a05e575ae83f605c89cbc12b0b0f35a058d0c7687980d68
SHA512015513c4ffd3a13a132a3c58a09b951931c94e63159534ae32c57d11d4a483604355b750aa4f5f079157e9f3b9f7d0f92ca5f58694717a192f75080504da036c
-
C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe.exe
Filesize129KB
MD511111df26aba5a177fbd3ff2821a9e5d
SHA1dba82329673e02dd99adbeb2d20538d10b6f484a
SHA25625e0e882cca2fc89942924ae208abf9059fe3f8bd87a16f788f8aad1f61521df
SHA5124d814017ce21b06208b5cd6814d40e801283a41216ea27986a88af50d2d61d23e9c54c0aafe6a8c509a94d156c59fb3dc8f46b902bcbc5acd185a712d31b2034
-
Filesize
39KB
MD5bc43e3c481e7fbe3ee697f9017cf4c1b
SHA16a76534a3a4bd72437b06bdccf1475846d7a308d
SHA256c33f277a3cea2a938fc05fda7bf9b9a0ae89474eaacf6b0b6223e07eb4ec3b6a
SHA512e5c2f3485b7573a6638f6d5ea2907371efc68b35655739e8e0c8f841de9c2d302b246eacb9627912cee5dd7ab0a9f7f652e73eb7d1925ddde20bb92e29310ce1
-
Filesize
9B
MD5f29b71f66ac42a28a8d1e12a13d61861
SHA1bd61fbc8b6eed4cae3fa29d7b950784258be10cd
SHA2569a5e4ff44f8f5bb21798074ea03e493911b59680e37191522562dece826da1cf
SHA51290c31cda60a9a63e3fa78e99f1104d1a9c9f811e11b62f75063b6007ae284c8c233b5d1235defab7ae0deec3b7892c85af9319219405c44d16fa29a3215f50e0