Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:32
Static task
static1
Behavioral task
behavioral1
Sample
64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
Resource
win7-20240215-en
General
-
Target
64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
-
Size
264KB
-
MD5
ad9b009d9569c9bf6baeb4b690f42adf
-
SHA1
124ee22361eb16367a8e2f3ff385a7957410b335
-
SHA256
64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f
-
SHA512
cf86b80db82bbd115610bf3dff67e5154f4091b34c318dfcec89911bb9154dee9d7c82993d2fb4902e2a7ca0e1ff4fe1e5266905b84d38c0081e7a2b43bdbfc5
-
SSDEEP
6144:l/KW+aezigiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:wW+aYitXqsTkiR7twRx+gD8PJ
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exe64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exepid process 4416 Logo1_.exe 1904 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini Logo1_.exe File created C:\Program Files\Uninstall Information\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe File created C:\Windows\Logo1_.exe 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exeLogo1_.exepid process 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exenet.exeLogo1_.execmd.exenet.exenet.exedescription pid process target process PID 4648 wrote to memory of 3488 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe net.exe PID 4648 wrote to memory of 3488 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe net.exe PID 4648 wrote to memory of 3488 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe net.exe PID 3488 wrote to memory of 1168 3488 net.exe net1.exe PID 3488 wrote to memory of 1168 3488 net.exe net1.exe PID 3488 wrote to memory of 1168 3488 net.exe net1.exe PID 4648 wrote to memory of 1720 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe cmd.exe PID 4648 wrote to memory of 1720 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe cmd.exe PID 4648 wrote to memory of 1720 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe cmd.exe PID 4648 wrote to memory of 4416 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe Logo1_.exe PID 4648 wrote to memory of 4416 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe Logo1_.exe PID 4648 wrote to memory of 4416 4648 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe Logo1_.exe PID 4416 wrote to memory of 4568 4416 Logo1_.exe net.exe PID 4416 wrote to memory of 4568 4416 Logo1_.exe net.exe PID 4416 wrote to memory of 4568 4416 Logo1_.exe net.exe PID 1720 wrote to memory of 1904 1720 cmd.exe 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe PID 1720 wrote to memory of 1904 1720 cmd.exe 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe PID 1720 wrote to memory of 1904 1720 cmd.exe 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe PID 4568 wrote to memory of 3472 4568 net.exe net1.exe PID 4568 wrote to memory of 3472 4568 net.exe net1.exe PID 4568 wrote to memory of 3472 4568 net.exe net1.exe PID 4416 wrote to memory of 396 4416 Logo1_.exe net.exe PID 4416 wrote to memory of 396 4416 Logo1_.exe net.exe PID 4416 wrote to memory of 396 4416 Logo1_.exe net.exe PID 396 wrote to memory of 2024 396 net.exe net1.exe PID 396 wrote to memory of 2024 396 net.exe net1.exe PID 396 wrote to memory of 2024 396 net.exe net1.exe PID 4416 wrote to memory of 3444 4416 Logo1_.exe Explorer.EXE PID 4416 wrote to memory of 3444 4416 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50DF.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.exeFilesize
583KB
MD5c242260e04c259e5b86393e7fc483c58
SHA1362241689204b12908af66e9a1cb34249efc19cb
SHA2564b3d340a135393c503d5ec532c93ebf36602899e81dddacda4ec382cc9b5a68c
SHA51216da1a4cf681c2dc8d4cc311137fa8c45fbd086b116c5bcb066a73ba89cbdc1c0e53bfe69eb2a2d214b1499268b2bdbf22791652f7567249ff435ffb8c6e4d48
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exeFilesize
649KB
MD5006e8207aa163306a5174b6dea4b573f
SHA1412a2165e9732fcae518386013c7d0d124c58780
SHA25697b5e11d59b882a2bec3e62394e53ce8d2aa96f24ba4f991d43422ba452afeef
SHA5125234a1fc74155bc5a0e02728e691003d51cd9b23b75f196964883600cf148776f3833d3237bc00d7f27cf0b7f15f3bcc3dbe37a00883eeb9c3cd0c93bdb3a2cd
-
C:\Users\Admin\AppData\Local\Temp\$$a50DF.batFilesize
722B
MD52af6f5a698bba25624535c6478321c31
SHA16b0f24b2cb21cdbd5aa9d90d5ffd94e1c664a307
SHA2561dbdb6bc27ffe42a51afbb5c815895bbe035977231060f497815a082406a2694
SHA5124d243e5f84490a2d7b9f0058711ad21973653d62c0871d87a9f566d5029095e5587a83f78a27a43e605aae9f1847fddd7da4b4403f4650c29797a2489f83c6e1
-
C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe.exeFilesize
224KB
MD5d4b257c01bbaa68d15d8368475a4e227
SHA1fafae083a882e163cfa8c77258baaab891c17df2
SHA256dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546
SHA512167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502
-
C:\Windows\Logo1_.exeFilesize
39KB
MD5253b6789d1d5e4699bfc49109ab67490
SHA114f55722f832b7a172d3dfd47d6688607b3d5fcd
SHA25636452d9a6405a90cf6c493850f489326b6e9b36ab223bac70ebd7c6202e7f4d6
SHA512b21643bf9817af9255865ed5534b155ef9a6686bc5b2c3a0de2a29d270c9bb3d58d5fb411053e76cdf6367eb8fee3c0a6543da926b3d7431ec51c752d03c6985
-
F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\_desktop.iniFilesize
9B
MD5304501c003da3bc5756aa53a757c30cc
SHA194dfcea0ef17f89b3a60a85a07edb4c00170cc1c
SHA2569f4b03cbd52378f329bfc7088f8242bbc1a0a2754bc2f8a40e3b74e0dedecd6e
SHA51278cd3c2cb4cb66e41d8947e1231256c2043d71c77f97e92915e938a6c1d9a8c003512027d98bc71bf582875d269e5fbe6e134f57b25f5f79fe16f9a412387dc8
-
memory/4416-11-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4416-18-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4416-5210-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4416-8669-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4648-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4648-9-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB