eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2

Analysis

max time kernel
151s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
Size

26KB
MD5

3f2d3014196588ffc6fc985863a505d5
SHA1

cd523f7c44dc62e45c5df5c60f732b1c4ecb661e
SHA256

eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2
SHA512

c22ec9c25a5ff334d53a725981466df13b82afd6a6d02b2eb3e84a07672ee5ccd461e2f8df8f3751fef7c8fcd0adb39b62f76b0f4730e0c143a3fcb0e5235887
SSDEEP

768:yo1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:ZfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\V:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\Q:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\O:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\H:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\Z:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\X:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\U:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\N:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\K:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\J:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\E:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\Y:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\T:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\R:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\P:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\M:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\G:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\S:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\L:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened (read-only)	\??\I:	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files\WindowsPowerShell\Modules\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3212	1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe	90
PID 1836 wrote to memory of 3212	1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe	90
PID 1836 wrote to memory of 3212	1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe	90
PID 3212 wrote to memory of 1764	3212	net.exe	92
PID 3212 wrote to memory of 1764	3212	net.exe	92
PID 3212 wrote to memory of 1764	3212	net.exe	92
PID 1836 wrote to memory of 3316	1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe	57
PID 1836 wrote to memory of 3316	1836	eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3316
- C:\Users\Admin\AppData\Local\Temp\eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
  "C:\Users\Admin\AppData\Local\Temp\eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
165KB

MD5
5fdec5bded45e9b50e1526e5f43e4597

SHA1
3c9bf070ee9a90eaaf2f6e4dde4c1227f70ca4e5

SHA256
cb7ed73d835a7205b37eb2956ee9b9d8ac8e40cf34dc6cb114ea63639935ff18

SHA512
3b19172089d908449517bd3bb02edfd3cbead235382ec6d518de08b2a0bd0e0d7d86718540cba31793bd7dae0fd365244c50415186ca0742fae6522a162893e3

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

Filesize
9B

MD5
7ef570b2b21e58fd906ef1a980d64425

SHA1
18502489f652e74f8972bbfa100d5c163d719ab7

SHA256
c3ce1b9216b58ac7d9ed3b93e5e3a1d6a2473b53b5bc1f008a621def49517055

SHA512
e1175d861a79d62b85cd18661375f1c956dcc97e958765dc225f3aa4b0f0100ca9e17b9c61f5e18fc2a96e5167c0563f60645033aff1be1ec2f372c1b9a8b35f

Download Submit
memory/1836-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-1002-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-1169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download