Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe
Resource
win7-20240419-en
windows7-x64
10 signatures
150 seconds
General
-
Target
a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe
-
Size
497KB
-
MD5
9dacbd16c744b80ac18ab1ba7240cbf3
-
SHA1
b8a3e0dc23ecabe9eb5e3a942d1acf08ad7bcf25
-
SHA256
a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f
-
SHA512
ce406b5cb018e81d82be891a1842a257f01fd25fd92308c3ce39a9638b438551d804fe919460de0f090d8a698271fe83f9cd2e73e8768270e506247224760908
-
SSDEEP
12288:u+azbvb1gL5pRTcAkS/3hzN8qE43fm78V:uBzb+5jcAkSYqyE
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3932 Logo1_.exe 2132 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe File created C:\Windows\Logo1_.exe a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe 3932 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3664 wrote to memory of 3564 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 84 PID 3664 wrote to memory of 3564 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 84 PID 3664 wrote to memory of 3564 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 84 PID 3564 wrote to memory of 2904 3564 net.exe 86 PID 3564 wrote to memory of 2904 3564 net.exe 86 PID 3564 wrote to memory of 2904 3564 net.exe 86 PID 3664 wrote to memory of 5008 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 90 PID 3664 wrote to memory of 5008 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 90 PID 3664 wrote to memory of 5008 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 90 PID 3664 wrote to memory of 3932 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 92 PID 3664 wrote to memory of 3932 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 92 PID 3664 wrote to memory of 3932 3664 a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe 92 PID 3932 wrote to memory of 1704 3932 Logo1_.exe 93 PID 3932 wrote to memory of 1704 3932 Logo1_.exe 93 PID 3932 wrote to memory of 1704 3932 Logo1_.exe 93 PID 5008 wrote to memory of 2132 5008 cmd.exe 95 PID 5008 wrote to memory of 2132 5008 cmd.exe 95 PID 1704 wrote to memory of 2224 1704 net.exe 96 PID 1704 wrote to memory of 2224 1704 net.exe 96 PID 1704 wrote to memory of 2224 1704 net.exe 96 PID 3932 wrote to memory of 2476 3932 Logo1_.exe 97 PID 3932 wrote to memory of 2476 3932 Logo1_.exe 97 PID 3932 wrote to memory of 2476 3932 Logo1_.exe 97 PID 2476 wrote to memory of 4460 2476 net.exe 99 PID 2476 wrote to memory of 4460 2476 net.exe 99 PID 2476 wrote to memory of 4460 2476 net.exe 99 PID 3932 wrote to memory of 3544 3932 Logo1_.exe 56 PID 3932 wrote to memory of 3544 3932 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe"C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E98.bat3⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe"C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe"4⤵
- Executes dropped EXE
PID:2132
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2224
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4460
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5266a8decd1271ba104a9fff2eb37568f
SHA15fae11187d40c55a75f7174e4af12fef3e0a33a9
SHA25625040ab6bb8ee761b351ca816cce03c80530b89aba11824a74326e84277e2aee
SHA51215e0794324d0066c7cef77dc1f48441d2ddfa355a683c3a49cc6ead86399121122a49c449306330796600b7aa46679b20b9797e8e14aa2ef183102bd8dac304e
-
Filesize
583KB
MD51fc45864b434b1740a433ce8eb0d7e29
SHA1791372c8ab7efb7c0301d96f84889e246d4b4384
SHA256c829fce99133b730c0d7e47f49768872a3f2fd6e782e462194427814f57d2699
SHA512c3734916f06140072101a2faa1ba229d67c6f89731e464cf6f985617607053736cb429dcc6df1c42820c2fa054e9eb857b3eaf7170b4a18f1a56f7573f089ecb
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD5e4b4c486987a76abb8a18c33b36514b5
SHA11c83216295cfc852c1a35198e31d8d385efd373a
SHA25630f0474b455caa56bfb989bfcc04bb4db00f81857c28657f3fecf1dbcc6eb5dc
SHA512f8532180a32b17153626d9879a93159132b2e10708e81aec83c995a8e9b642d5b6ccdd1db676c92302bdd5bb97726e670876490e97d65b27865ea7e72c8c4515
-
Filesize
722B
MD5165317eb2c09e472a0150a5b7b142204
SHA179366494cc167054c41a75be32d0665cb438f8d3
SHA2567189119099099e81327160326914f4d000c350f53a4881af8f116e55bb8bea22
SHA5124ec0c51ea8da0e716e0d5417b872dff5e80fb0b3a9f0809d9fef1609651dfeba2406174bdf24763b010ac4453d344eb67f3e820d8c07ce79083335ed5ea3070b
-
C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe.exe
Filesize458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
39KB
MD54ea1c860080808fe13e78caa0034c62b
SHA159e326df70ba545b4c443b9a4d4d4ecb725a0ede
SHA256fef391543155b7d88565a03cdcb35eb2d9c44b22f3d4af8ef9fd0f48289f6958
SHA512880bf02f0776da8fde359b6f71b05ed11947f507d44e461f23c55dbeabc54ce63325c877fac5dd2d31c5dad3feb0d81bf02f767ac238494ef7ca5c84ec354e6f
-
Filesize
9B
MD53441ca64b7a268fd1abb0c149aa9e827
SHA1977a6be7624a5ff4ea1de4f422b44b4974c17827
SHA256fafa54a384b4b9bfe970b0e803afe0c0284021acca503892961170d49985dd99
SHA51284d8adce555267049d33544c4402eaa9bb3ff2022fd76cd619e4cb1fd544c5825cd7769065dd525b58e3befd579d3dd11ec2e0032907ff7dd36f83975b5b5848