Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
Resource
win7-20240508-en
General
-
Target
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
-
Size
47KB
-
MD5
35ad4a5df82a58e29516cc6cecfa7988
-
SHA1
8839daf770de6a149ca22983450353f67c3ed009
-
SHA256
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36
-
SHA512
f7cc0b34b0682e1f522f6723f5800968782f1c86f91f3c640779438c7609e2f468b51a114dbb9eb864ff68fe350ef73e97addd3fe1dad1b8f08c2cbc98f9f411
-
SSDEEP
768:QioRJbj/O5RroZJ767395uINCjPZf44S6nCaexaNjWQ3655Kv1X/qY1MSd:QioRJbj/e+Zk77RNCLp44x6UHqaNrFd
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exeb914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exepid process 2408 Logo1_.exe 1548 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Program Files\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
Logo1_.exeb914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exedescription ioc process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe File created C:\Windows\Logo1_.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exeLogo1_.exepid process 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe 2408 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exenet.execmd.exeLogo1_.exenet.exenet.exedescription pid process target process PID 648 wrote to memory of 640 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 648 wrote to memory of 640 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 648 wrote to memory of 640 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 640 wrote to memory of 4856 640 net.exe net1.exe PID 640 wrote to memory of 4856 640 net.exe net1.exe PID 640 wrote to memory of 4856 640 net.exe net1.exe PID 648 wrote to memory of 1064 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 648 wrote to memory of 1064 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 648 wrote to memory of 1064 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 648 wrote to memory of 2408 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 648 wrote to memory of 2408 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 648 wrote to memory of 2408 648 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 1064 wrote to memory of 1548 1064 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 1064 wrote to memory of 1548 1064 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 1064 wrote to memory of 1548 1064 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2408 wrote to memory of 1616 2408 Logo1_.exe net.exe PID 2408 wrote to memory of 1616 2408 Logo1_.exe net.exe PID 2408 wrote to memory of 1616 2408 Logo1_.exe net.exe PID 1616 wrote to memory of 5052 1616 net.exe net1.exe PID 1616 wrote to memory of 5052 1616 net.exe net1.exe PID 1616 wrote to memory of 5052 1616 net.exe net1.exe PID 2408 wrote to memory of 3660 2408 Logo1_.exe net.exe PID 2408 wrote to memory of 3660 2408 Logo1_.exe net.exe PID 2408 wrote to memory of 3660 2408 Logo1_.exe net.exe PID 3660 wrote to memory of 2492 3660 net.exe net1.exe PID 3660 wrote to memory of 2492 3660 net.exe net1.exe PID 3660 wrote to memory of 2492 3660 net.exe net1.exe PID 2408 wrote to memory of 3240 2408 Logo1_.exe Explorer.EXE PID 2408 wrote to memory of 3240 2408 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
258KB
MD5087437b5d40197b39196f13de881a4c3
SHA11730cf453aae759eb6270bd4268270f99648019c
SHA25664300550756f2872e5cc83e44b3a9e9a1fd48db40d70255244d7fea2d7188256
SHA5129cf8e79721002615fd73b80ad843b5a36db0fab4adac9a9411800b0e506b25b61fdaf939ea2bb60291694abc50449afb4106e3af327971b89d926624c9d00ae0
-
C:\Program Files\7-Zip\7z.exeFilesize
577KB
MD5b18288af60b5a5145bcc8c16d5f876e0
SHA15997adbc3d70e593914f7084ce020739e8eb390c
SHA2563d62454a3b6609ca8420823c9443f2cafb90aa55ad139681d86b7b124beaca3f
SHA51283dd4b6c63bfc7bca51e9e7b58411c3b6cf8419db0356fbd1254f27fb6434e995f6a8fd9acf47a67a50d073d0a865c31adc42cdd4ee1589b5dd5913e8ffc555f
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exeFilesize
488KB
MD585b76d0e0da4b34c0acc7abcd83d7150
SHA13c361c827353e87281950c2baef4ed7a24eee844
SHA256a2beda607517ea941d193ff76cd746ba01dd55a62725874c59e93776cf3f3f53
SHA512407a41a1fd8a4e24dbddbc624a50a94d101c541e9d73e5db4b1fa68fd2915c1cb92f6444fa8416429134b88610de31be620eaacda2b9a96e76182ca2323c3644
-
C:\Users\Admin\AppData\Local\Temp\$$aD6.batFilesize
720B
MD5c0d2ff75186424903714c7f2e203aa48
SHA10234f493b6fec57ef8e9070f60a5fdb1be023195
SHA256f002213517afbe609dad87b9644b4fd4e7d0e56f126898fd62805cf45820a5db
SHA5124038f96901973d7a6e26216907ccca12593aaa1ed6a20996b25d564c41beda36d51c7acc42fe0e69323d239c03d7939805b27a0ad344e40c171f4a2783f9c9bd
-
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe.exeFilesize
14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
C:\Windows\Logo1_.exeFilesize
33KB
MD5a51381d9a97c98438725ecee862236b3
SHA1fab4fca7633bc7de56ad02bc5a8165e709e9f06b
SHA25684aa7b7f5581336f4b54c55b70d17c1fb0460db983f55739d01d158eedee8668
SHA512c70207ff04c9a65c2f06400b65ca7597d075743af5c62e02b625e4ed30289075fe314872bbbb6037833e1eb6d5b07c506392637e3122ef642e6afb544a0ee82e
-
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.iniFilesize
9B
MD531874817e0fb055be8d2c971c0e3bbde
SHA1ee8a35d6a86cb6d13f354d67d912e194bb09c74b
SHA25694de8b492bc2db9a9592f7c9433547eb7f80826ed67f48d2bb7e22db9d49f544
SHA51255747c69ae50fa212576d095f60cf33b42e26789cf8c34fc5120a45b1988aae95f91d9e37cb17298c5ac5243b2e4c40e1d0e084ce7fe14bceb4ebb318c65c944
-
memory/648-11-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/648-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-323-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-1723-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-2468-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-9-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-5434-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-18-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-7543-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2408-8817-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB