Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 02:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
General
-
Target
dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe
-
Size
577KB
-
MD5
68a6a34f59ff749de9e4aca05bbc1fa0
-
SHA1
0228c376a2934591a6e9487ba20f9a2c67190c90
-
SHA256
dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa
-
SHA512
556c5570fd43d0a1d9eb289fc095c6dbcbbc30ae29a4ae959fc1aef583ab375fff9b043de7477940d44aeb4672e64fa9eee416b0e0e21eb73fd68489d61b5ae7
-
SSDEEP
6144:Ff46tGdye419E7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQC:x3NbI7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4180 Logo1_.exe 740 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe File created C:\Windows\Logo1_.exe dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe 4180 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1900 wrote to memory of 4272 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 81 PID 1900 wrote to memory of 4272 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 81 PID 1900 wrote to memory of 4272 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 81 PID 4272 wrote to memory of 1896 4272 net.exe 83 PID 4272 wrote to memory of 1896 4272 net.exe 83 PID 4272 wrote to memory of 1896 4272 net.exe 83 PID 1900 wrote to memory of 4864 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 87 PID 1900 wrote to memory of 4864 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 87 PID 1900 wrote to memory of 4864 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 87 PID 1900 wrote to memory of 4180 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 89 PID 1900 wrote to memory of 4180 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 89 PID 1900 wrote to memory of 4180 1900 dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe 89 PID 4864 wrote to memory of 740 4864 cmd.exe 90 PID 4864 wrote to memory of 740 4864 cmd.exe 90 PID 4180 wrote to memory of 5032 4180 Logo1_.exe 91 PID 4180 wrote to memory of 5032 4180 Logo1_.exe 91 PID 4180 wrote to memory of 5032 4180 Logo1_.exe 91 PID 5032 wrote to memory of 772 5032 net.exe 93 PID 5032 wrote to memory of 772 5032 net.exe 93 PID 5032 wrote to memory of 772 5032 net.exe 93 PID 4180 wrote to memory of 3256 4180 Logo1_.exe 94 PID 4180 wrote to memory of 3256 4180 Logo1_.exe 94 PID 4180 wrote to memory of 3256 4180 Logo1_.exe 94 PID 3256 wrote to memory of 3168 3256 net.exe 96 PID 3256 wrote to memory of 3168 3256 net.exe 96 PID 3256 wrote to memory of 3168 3256 net.exe 96 PID 4180 wrote to memory of 3448 4180 Logo1_.exe 56 PID 4180 wrote to memory of 3448 4180 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe"C:\Users\Admin\AppData\Local\Temp\dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48F0.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe"C:\Users\Admin\AppData\Local\Temp\dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe"4⤵
- Executes dropped EXE
PID:740
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:772
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3168
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD568a6a34f59ff749de9e4aca05bbc1fa0
SHA10228c376a2934591a6e9487ba20f9a2c67190c90
SHA256dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa
SHA512556c5570fd43d0a1d9eb289fc095c6dbcbbc30ae29a4ae959fc1aef583ab375fff9b043de7477940d44aeb4672e64fa9eee416b0e0e21eb73fd68489d61b5ae7
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD551c1eb02821359551eae62ff451ccbb4
SHA1917e11eb8a26a033a330a9cee5c5207d0da1109a
SHA2569afbb3fd781ea931d8bc856c768fe7af7e440e9f7a29950b5dca44593f0ef04f
SHA512062f0c32d3d9b46fc670512a818c88919bcc90a2f7f5bd4910f917a96c42527fd6c28117c366cb66cd6bfa3ec64f5a43aadcaa4bdad01c8d45eb2bfe2c85f5ee
-
Filesize
722B
MD59bb053dbf43c5484fe8d30b977d5ac10
SHA1743a04106ee2e20ba09300c3f10e7774902393f6
SHA25666d627bc8ed9e2cdc6e8e9928b3662fce78b6a746bc7e64b3d386ed17b03bae2
SHA512813f114742d8755c08d20bc746ba0cda7185748cceebf3ca0d7955a86730cc07f07224dfe70b3394950359efbc393b192fa3c258847689c18ebc83b5ad1fa0f6
-
C:\Users\Admin\AppData\Local\Temp\dc2b6cab038a5ee8c47b6f877b4704da0786a4bcb1497a43844adadd17bb44aa.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
33KB
MD54ae178187c14818b14f422c6c887fc5d
SHA11a66d36dc661f5bcc86f995d352f0d094c3c3cb1
SHA256f38854d1e223621da707383885c1f2eb5d422c4d8b35a2254cc4df9fdf998799
SHA512c810c8f9d1c30837e75c81e5ff3276cfa5beb26f40042eda4a66d8b626e0dd648181a29dcef6aea59456fbea7000870825d8cfd8ac9749429b96781657768868
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD54d28283e4d415600ffc2f8fda6d8c91e
SHA1053dcb8d5d84b75459bc82d8740ee4684d680016
SHA256b855effeaf01610130d3f38de35bc7f98bfc6643d98d4198af18534f048e8df7
SHA51273a758cd5e5ac48d62dd89719be604214895e0cc9a10ff7464a6cf9161a37fd27d15dd2d2565f18198b381ac6442bcb36f38614df7b1176061a83616517a7edb