Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe
Resource
win7-20240215-en
windows7-x64
16 signatures
150 seconds
General
-
Target
8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe
-
Size
447KB
-
MD5
6ba91e4005d74badcf8af8a7eb30081b
-
SHA1
5a62af4adce23da7124b48a757a1ae9eda3487f9
-
SHA256
8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc
-
SHA512
87f7acd72f99cc35a7c5d358f242495e2b1b7c33b032aae38f3382c491ff1a6a2c48cedaec74f6d814c1384d06d3d0ce36379e5fc25bfdaf38cc597c52f04e92
-
SSDEEP
12288:K3NVA65XwlYgrHy6V17kr8+m73q+pgkxzdxRlabQYtCAZ5cIkKix:K3NXwlBrygOW3q49ldx7XIa
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3608 Logo1_.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0010000000023a5f-15.dat upx behavioral2/memory/4888-17-0x0000000000400000-0x00000000004F4000-memory.dmp upx behavioral2/memory/4888-21-0x0000000000400000-0x00000000004F4000-memory.dmp upx -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4888-21-0x0000000000400000-0x00000000004F4000-memory.dmp autoit_exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe File created C:\Windows\Logo1_.exe 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe 3608 Logo1_.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 4888 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3120 wrote to memory of 540 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 83 PID 3120 wrote to memory of 540 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 83 PID 3120 wrote to memory of 540 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 83 PID 540 wrote to memory of 1896 540 net.exe 85 PID 540 wrote to memory of 1896 540 net.exe 85 PID 540 wrote to memory of 1896 540 net.exe 85 PID 3120 wrote to memory of 2228 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 89 PID 3120 wrote to memory of 2228 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 89 PID 3120 wrote to memory of 2228 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 89 PID 3120 wrote to memory of 3608 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 91 PID 3120 wrote to memory of 3608 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 91 PID 3120 wrote to memory of 3608 3120 8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe 91 PID 3608 wrote to memory of 1688 3608 Logo1_.exe 92 PID 3608 wrote to memory of 1688 3608 Logo1_.exe 92 PID 3608 wrote to memory of 1688 3608 Logo1_.exe 92 PID 1688 wrote to memory of 5112 1688 net.exe 94 PID 1688 wrote to memory of 5112 1688 net.exe 94 PID 1688 wrote to memory of 5112 1688 net.exe 94 PID 2228 wrote to memory of 4888 2228 cmd.exe 95 PID 2228 wrote to memory of 4888 2228 cmd.exe 95 PID 2228 wrote to memory of 4888 2228 cmd.exe 95 PID 3608 wrote to memory of 4620 3608 Logo1_.exe 103 PID 3608 wrote to memory of 4620 3608 Logo1_.exe 103 PID 3608 wrote to memory of 4620 3608 Logo1_.exe 103 PID 4620 wrote to memory of 3288 4620 net.exe 105 PID 4620 wrote to memory of 3288 4620 net.exe 105 PID 4620 wrote to memory of 3288 4620 net.exe 105 PID 3608 wrote to memory of 3564 3608 Logo1_.exe 56 PID 3608 wrote to memory of 3564 3608 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe"C:\Users\Admin\AppData\Local\Temp\8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a467F.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe"C:\Users\Admin\AppData\Local\Temp\8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4888
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5112
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3288
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5763c0a024e1d5025284ffc74e8888687
SHA18c85ed8a02fb64c557ed0b66b8ccac50343f0a8f
SHA256d122c656ea45dafaf12f725b2a574525634ab65ad686757db2964cba6a58ddf8
SHA5122d8d0249ebaf9206a9ac091493b462cecf1a98a0334c4e9ba562bf4d481d5d8cbc9904af3986dd7c8ff7cc73f34ee7a6cca95cb4e73f3f955bb78d9d82b34b31
-
Filesize
577KB
MD5e0cce817425e080a14a7e33d0075e769
SHA15c0cef80abe56e0eda13a88a9a7578c804a4823e
SHA25682780bc00258b09c6ad87422034b04b766ed7157258c00afd0f52b8dd3a54992
SHA5128983032b7c30771a443247412ee5324782c62733979f8b13385c8ac0cdd54130c7f60513b6e951740ea923cb4784e83a6a75f1f377fd6117fd74e8fa5cff2a9e
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5635e9422a0a86f5c7ac989802b0ac448
SHA13ea9cc1462b063639526a8d278b571f38b846d1d
SHA256a97d8545a6204abf1a179f2098ca8780e92f4448c7a03e62f6c32e8e5e5cb17f
SHA512857c6d683fe1f7a6757420c84efc4f7f48f58e586e601c969ce27e4ded8cad6ca774ef367a1a1e075081c4e2d41f8cdda558fddf5622e062975cfeff5a929133
-
Filesize
722B
MD5f0fae1162a040415779f6215b84b3ad9
SHA1b03c6c369dbfa01725d7bd100bd9a0ccf0b68c88
SHA256fe09fa1490e00b6f9a95afda717a5c7a4cfa1b83dac397f818f3629592148594
SHA512c55038a45d19e0d049f3b1a385dea23c2c0897e36f2639f8ace03f450b063a5988050921d8457242bd9d983caa62a8601471bc2d49673a1d42fe583d57e161b8
-
C:\Users\Admin\AppData\Local\Temp\8edfac4f1f3cafbd43638f0d2c658009b519b9f1bd3171ba8dedb0448f531ffc.exe.exe
Filesize413KB
MD561f00cd504821ba3727f40ba91c0aa38
SHA11923a6331cf73dde5af1cb5573f35d9cce3a86b6
SHA2567d317c9d43001251d8ba8ad9c81d2959e8a8030927ff3b7ed6a3b91840409552
SHA512f1efd9094f5a6a14e19b2e418605c65be4fc0505e231072503786caefb42651ff9df2d3504c7bb84373097cc25651e495be85003ae45e81bd5e0ce22bb489935
-
Filesize
33KB
MD54d3bfe6c87e6c78b7046c15ab105081f
SHA1c412923129b6accf951aaa82e640306b9344f2f0
SHA256dc7df265a1202af0cb3bbdb171b6569dbd60ff0ef9aecff6b82df3d3e727ca4b
SHA51233320eec5c3066612b3c9bea4f39373d3d1c7023a88bf4c1f28d94b8f7aa458d36578f0cf34e3016170fea08f6bc0b0714d5db1318f3eb68d6c188afef2bd013
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD51b16d2dbd4281ce4e4e5729c608dcb0b
SHA1851e624080ba5598edb808d4b30fe2d74999ce18
SHA256c9e46fb51d0588ca1e48ca66731e11992770b9b74a982f9bdbb6ce5b5b75d549
SHA512cd1c4cf7c7871cb48ce735226b25f689b340037e6c992441e566161de7fca7410762d1a0c2670ee4b6546f7ee854d3219e0e2315c3e0387d9bbe3f08076b5a59