Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe
Resource
win7-20240221-en
General
-
Target
57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe
-
Size
39KB
-
MD5
47ec98bc87cb912543336ed8e6046f36
-
SHA1
72ef5db4c258a4b74bfa2049178a007f4eed7731
-
SHA256
57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4
-
SHA512
e5f03aa980594cbca251eb2723514096ee8cc9b65327d37df3794cb6768666ca848a32d47d8992647cace51ba1f96fa38f9329da346148092230af3fe3f7b8e5
-
SSDEEP
768:8J0eUHoO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:8NFe+Zk7VJbwlYXjPrsqrZMYR5p8w
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\T: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\L: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\I: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\Z: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\X: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\R: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\P: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\M: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\E: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\Y: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\W: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\O: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\N: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\G: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\H: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\U: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\S: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\Q: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\K: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened (read-only) \??\J: 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe File created C:\Windows\Dll.dll 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1164 wrote to memory of 2012 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 83 PID 1164 wrote to memory of 2012 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 83 PID 1164 wrote to memory of 2012 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 83 PID 2012 wrote to memory of 3888 2012 net.exe 85 PID 2012 wrote to memory of 3888 2012 net.exe 85 PID 2012 wrote to memory of 3888 2012 net.exe 85 PID 1164 wrote to memory of 2204 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 89 PID 1164 wrote to memory of 2204 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 89 PID 1164 wrote to memory of 2204 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 89 PID 2204 wrote to memory of 4068 2204 net.exe 91 PID 2204 wrote to memory of 4068 2204 net.exe 91 PID 2204 wrote to memory of 4068 2204 net.exe 91 PID 1164 wrote to memory of 3500 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 56 PID 1164 wrote to memory of 3500 1164 57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe"C:\Users\Admin\AppData\Local\Temp\57bfa721e69f4e1a59b6b0c14c0f1b60b5c67b1a2f90dcb14ff4c6f2d9ec9df4.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3888
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4068
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD5700b9e9d560c8da74ec37ef515f4ef35
SHA1640da02b51ed5662386409e1c6d8df2268b2dec8
SHA256e8cd802872fcd5501549e60bfc366a2b4905a2e890efb36f4ccc41ab5ccb1d55
SHA512782da744c4201f43a8fd84f37cceec60146b8b86711016fa28f1bdd0190e167bdbb9a47ee210e725571d328f2c9c97771ba78b8b49be78f3d590793021ba89da
-
Filesize
723KB
MD5b87530d273fc6a39d507d8a7f37b834e
SHA1c1ed4fe0bd7c96cc3df56cde66639fe6b9f7ec3c
SHA2567ca7b4a9091ce7bb2cf953c29f09fd0370cb20faf6119bc8d56c4a33f7cd195f
SHA51222a09585d776fb46e1f66d2843e5a41ac89cd188a14f508d5bfe8914523610e9c42d0fdb0ffcbb353fbfcfc142391b7e8374f1f64f62cd0f587a0f70217a326d
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD5e4b4c486987a76abb8a18c33b36514b5
SHA11c83216295cfc852c1a35198e31d8d385efd373a
SHA25630f0474b455caa56bfb989bfcc04bb4db00f81857c28657f3fecf1dbcc6eb5dc
SHA512f8532180a32b17153626d9879a93159132b2e10708e81aec83c995a8e9b642d5b6ccdd1db676c92302bdd5bb97726e670876490e97d65b27865ea7e72c8c4515
-
Filesize
8B
MD5ec89b9cba2f5e7b9394fdd901d6c3977
SHA163b0db3abcd08b863a9a3944799b41efa264db40
SHA2562b4efa4e113d3044c8e47f59a7b75225cc7736c2fa28f9e52949b9441f3d77ca
SHA512901f7d44754e59fba0b1b90341927744f670463f4d18e2694617f74fe4e3f456e9088530bccc16e758fc67a23f91380a3655121ba911e8ff5173f3ac4cb0f1d2