Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 14:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
-
Target
39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe
-
Size
491KB
-
MD5
c8b160531aa8d9f736d9ff319ceb61ce
-
SHA1
754418ea63855b579c9aa67587aa87279ea3907e
-
SHA256
39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5
-
SHA512
ef9c345b35f6f91d1271a1382f3ba61b826d27e9d60cd1b1a2f1c97dda6a2afd1bde76ed71bb9cc8d5eeeb3947ada823f1c2a331cbb28f05d9271b3024e50e31
-
SSDEEP
12288:t1quIf1gL5pRTcAkS/3hzN8qE43fm78V:t1q45jcAkSYqyE
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4164 Logo1_.exe 3720 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe File created C:\Windows\Logo1_.exe 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe 4164 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 456 wrote to memory of 1428 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 84 PID 456 wrote to memory of 1428 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 84 PID 456 wrote to memory of 1428 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 84 PID 1428 wrote to memory of 2856 1428 net.exe 86 PID 1428 wrote to memory of 2856 1428 net.exe 86 PID 1428 wrote to memory of 2856 1428 net.exe 86 PID 456 wrote to memory of 5040 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 90 PID 456 wrote to memory of 5040 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 90 PID 456 wrote to memory of 5040 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 90 PID 456 wrote to memory of 4164 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 92 PID 456 wrote to memory of 4164 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 92 PID 456 wrote to memory of 4164 456 39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe 92 PID 4164 wrote to memory of 3056 4164 Logo1_.exe 93 PID 4164 wrote to memory of 3056 4164 Logo1_.exe 93 PID 4164 wrote to memory of 3056 4164 Logo1_.exe 93 PID 3056 wrote to memory of 4168 3056 net.exe 95 PID 3056 wrote to memory of 4168 3056 net.exe 95 PID 3056 wrote to memory of 4168 3056 net.exe 95 PID 5040 wrote to memory of 3720 5040 cmd.exe 96 PID 5040 wrote to memory of 3720 5040 cmd.exe 96 PID 4164 wrote to memory of 4424 4164 Logo1_.exe 101 PID 4164 wrote to memory of 4424 4164 Logo1_.exe 101 PID 4164 wrote to memory of 4424 4164 Logo1_.exe 101 PID 4424 wrote to memory of 3348 4424 net.exe 104 PID 4424 wrote to memory of 3348 4424 net.exe 104 PID 4424 wrote to memory of 3348 4424 net.exe 104 PID 4164 wrote to memory of 3432 4164 Logo1_.exe 56 PID 4164 wrote to memory of 3432 4164 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe"C:\Users\Admin\AppData\Local\Temp\39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a468E.bat3⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe"C:\Users\Admin\AppData\Local\Temp\39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe"4⤵
- Executes dropped EXE
PID:3720
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4168
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3348
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5eabcd538f504610ed542dc20ec7662e4
SHA17e2511244c6dd3d004d76aa6c41423e4890e9009
SHA256d4d01768dd44f6b98cbff4b056f49c7a7121489fe389c8b7f7438d3716b6db8f
SHA512d1b9ae56ccc39a29bbc9710a81f8a953ec2b579d64c8e3a64341d2b34920ea30729ec060e9281fa474f46746f798c473f819bf5a423bee6e0b879687cffcb897
-
Filesize
577KB
MD5524c3600812aaa423bc87534f4aa48ad
SHA1a750d31821ce6f343e27ccb1eedc8ca818568cda
SHA25652833632f6aaf7d36b01b63b7dc3943dcb6bf6e356cfcea7a88a57fd0237c8a5
SHA512cef695a0605c7eb7546375607ed63e3f9740ea14babe2a017c2828d91dbfe03d3e1b5ef93adb7ebc24bc1f00f7dc04a91e203d55444ef9fc1e53c7790873bbdc
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5ab2cb63e497f09bfe8be14bcf0f680b1
SHA1d116c92ed3c487a1dcde68e4e58e66a535627fe7
SHA256c60d34a999168bdce718de1e1e2642d8903fde2c2359e4850ca852995bc62739
SHA512f54fc6ad7bc41b97b6f600304f5e4cf7eddd733a018116282cf0b53c8b4a3b78b738011e70113420093320884099bc70908731e277e0369de0e7df67d146a21c
-
Filesize
722B
MD5c9726be5778895512b81ba21672d434c
SHA1f5a0b65b289845fb0465ee7eb7d11d34ab29082f
SHA25675705845aea538adce331011d9262a8c91c4ec8d02fbfd32c52ea21aa1cd6669
SHA512832449d95db025488990f5d3deb1616662f61e1450bcf0569dff41541c196d3daa705a0ef71f73b8d48b3d8b49eb32ad0cf9c3128a163303d0cf2e014f50f66d
-
C:\Users\Admin\AppData\Local\Temp\39de4483e57a19f1bea4653eb9f31d8cf6b5450adf9dfa262cd00edee4fe38b5.exe.exe
Filesize458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
33KB
MD5e66ec81a55072abc67e5c48adc2f771c
SHA1b7b45b11de92fafe2ccd0c5a0a1a1d24991eba5a
SHA2566a9fa6177b7f71bfa63a0274a9832d18bfecbdc663bf23e1580203a5456b8a90
SHA512097f9f98618b195a7af7814e7eddba5ce1c25bd3a0d7818e79b4dfda1d6d20b08b0f28dec64278015a62fd5a3bf7495ae2d65ccfa1c48fc7a30a6eb3d9cd8287
-
Filesize
8B
MD51b16d2dbd4281ce4e4e5729c608dcb0b
SHA1851e624080ba5598edb808d4b30fe2d74999ce18
SHA256c9e46fb51d0588ca1e48ca66731e11992770b9b74a982f9bdbb6ce5b5b75d549
SHA512cd1c4cf7c7871cb48ce735226b25f689b340037e6c992441e566161de7fca7410762d1a0c2670ee4b6546f7ee854d3219e0e2315c3e0387d9bbe3f08076b5a59