7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
Size

26KB
MD5

3d153dcacff504f7b5e164da6832ddf9
SHA1

c404f0efda88c7591ede4c2d70fd148cc331a5b1
SHA256

7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087
SHA512

1fdcae0ad2560165b38623c5f22ec3d1d4754506f3f41f2017bbdc1e93180abc30e52e18e559e4963442655ad39981f64efee64e81dc5dc392cc69087a212068
SSDEEP

768:1b7oa1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:JFfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\U:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\T:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\M:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\Y:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\X:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\R:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\J:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\G:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\E:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\S:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\Q:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\O:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\L:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\I:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\Z:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\V:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\P:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\N:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\K:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened (read-only)	\??\H:	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\ModifiableWindowsApps\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\VideoLAN\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 1616	4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe	83
PID 4388 wrote to memory of 1616	4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe	83
PID 4388 wrote to memory of 1616	4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe	83
PID 1616 wrote to memory of 4852	1616	net.exe	85
PID 1616 wrote to memory of 4852	1616	net.exe	85
PID 1616 wrote to memory of 4852	1616	net.exe	85
PID 4388 wrote to memory of 3484	4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe	56
PID 4388 wrote to memory of 3484	4388	7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe
  "C:\Users\Admin\AppData\Local\Temp\7fbae18fef5a61c7a2baaef16525a2e0e585018b92802ef0fcd0a23720009087.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
244KB

MD5
79cd7056da6e7321c681a1d9b9317ac3

SHA1
37fc38b9642cc7992df7a4e5cf84a28f98f1c834

SHA256
aabbf665f2f0796d26cfa422d948970b1a7447001df3688f0faa022330123ded

SHA512
b3c8fc79c7ae9f324339d34a354a4364bfad7b060d21e7f1c8205bd4af6bcea98fa27074719641e35c47d42b251055e996ba47018360c6d21e2e9eaebfa508ae

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
170KB

MD5
6d48f0b001917db36c5a94900043a01f

SHA1
54a2cc4ffb10c1cdeac74f6bbaf7c56ba969a015

SHA256
8642ab4417607cb31d4588fcda4dc442bf4ba4d9a59265bbdc65eab47f6445c9

SHA512
b8caf44b3e9b343f3bfdea9ede06a93a9f926d5e4cf5c95a5580c14690a02f652cfe36e1e48c55e415f959e46b0eef861021a562f7c35e03ac98395ff0bd8de0

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
2500f702e2b9632127c14e4eaae5d424

SHA1
8726fef12958265214eeb58001c995629834b13a

SHA256
82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

SHA512
f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3726321484-1950364574-433157660-1000\_desktop.ini

Filesize
9B

MD5
3441ca64b7a268fd1abb0c149aa9e827

SHA1
977a6be7624a5ff4ea1de4f422b44b4974c17827

SHA256
fafa54a384b4b9bfe970b0e803afe0c0284021acca503892961170d49985dd99

SHA512
84d8adce555267049d33544c4402eaa9bb3ff2022fd76cd619e4cb1fd544c5825cd7769065dd525b58e3befd579d3dd11ec2e0032907ff7dd36f83975b5b5848

Download Submit
memory/4388-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-1222-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-4786-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-5249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download