Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
-
Target
ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe
-
Size
8.0MB
-
MD5
bef1d5cd12e2521eb0ea27b53c5d9653
-
SHA1
49937fdf0b646ce00d788efb53f4bf00ec95c2af
-
SHA256
ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1
-
SHA512
356e8827606f73491f292247684b0e96c7ee0e9ad9081ac64d447f4ed06ed3079ea42b1f199849b8eaf90c213299c0a64564388b83bdd7d236f6c1b6ca1eeb70
-
SSDEEP
196608:yWXqhfXaZ+QdkZUO9N+e6qFFMrI7bGCcg:Hea3k16ycI+
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3196 Logo1_.exe 4280 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\de-DE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe File created C:\Windows\Logo1_.exe ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 528 wrote to memory of 3028 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 84 PID 528 wrote to memory of 3028 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 84 PID 528 wrote to memory of 3028 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 84 PID 3028 wrote to memory of 3984 3028 net.exe 86 PID 3028 wrote to memory of 3984 3028 net.exe 86 PID 3028 wrote to memory of 3984 3028 net.exe 86 PID 528 wrote to memory of 5036 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 89 PID 528 wrote to memory of 5036 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 89 PID 528 wrote to memory of 5036 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 89 PID 528 wrote to memory of 3196 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 90 PID 528 wrote to memory of 3196 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 90 PID 528 wrote to memory of 3196 528 ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe 90 PID 3196 wrote to memory of 1344 3196 Logo1_.exe 92 PID 3196 wrote to memory of 1344 3196 Logo1_.exe 92 PID 3196 wrote to memory of 1344 3196 Logo1_.exe 92 PID 1344 wrote to memory of 3628 1344 net.exe 94 PID 1344 wrote to memory of 3628 1344 net.exe 94 PID 1344 wrote to memory of 3628 1344 net.exe 94 PID 5036 wrote to memory of 4280 5036 cmd.exe 95 PID 5036 wrote to memory of 4280 5036 cmd.exe 95 PID 5036 wrote to memory of 4280 5036 cmd.exe 95 PID 3196 wrote to memory of 4248 3196 Logo1_.exe 99 PID 3196 wrote to memory of 4248 3196 Logo1_.exe 99 PID 3196 wrote to memory of 4248 3196 Logo1_.exe 99 PID 4248 wrote to memory of 1840 4248 net.exe 101 PID 4248 wrote to memory of 1840 4248 net.exe 101 PID 4248 wrote to memory of 1840 4248 net.exe 101 PID 3196 wrote to memory of 3376 3196 Logo1_.exe 56 PID 3196 wrote to memory of 3376 3196 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe"C:\Users\Admin\AppData\Local\Temp\ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D91.bat3⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe"C:\Users\Admin\AppData\Local\Temp\ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe"4⤵
- Executes dropped EXE
PID:4280
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3628
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1840
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5060347047d63427782c0376930785ff5
SHA1d78f3c47a404c115d0d79a175447a47871fd605e
SHA2565c5ac3fa6013be6c0602a7a6f8b24acb738e37366c43b67989091b9725adf51f
SHA5129811f2721f76f6d874ac390c516a7a3d5037a82c785d0c35540353b0827ac2fe24d7f1e8be8e6ae7278b00be9aa30f4d5385076e82576b38d1c36df6b09693d2
-
Filesize
583KB
MD53d13b844d2a2527640ed50d8da94b7b5
SHA177566d99b9a2938fdabcb84172496ff62957ad5a
SHA2565c77dc74765c0500f1023136ee097d938ef4da166a4874db26040e69dfeac992
SHA51272c8328aa9adf34c0fbc70a08a89fdb807b5b8fd19f35658d2a63f1044545668a21e0f973bbdf25221da9a8e93ccc5c6db4786d0a4702873a631e5a54adeaf92
-
Filesize
722B
MD554e0c8ca533e175f5653841f964e7d93
SHA1a3b4f702d70afa4f96be4f5ef5c9e83fbfadd0e9
SHA256e292bdddd3587525c23d5ac7fe461579eab02a3b2c26d20a48b33003bc602b6f
SHA512177b175a4b85152fb5a6767f94a954fb36c6fdfca635985e927d32c1789eb6ec35be85d37bb18900f058082027510c1496049434eda96c84d2de3f5472878eba
-
C:\Users\Admin\AppData\Local\Temp\ce21a3c8f429c06ffbe3139f9d2c81b49976cf2f3fe42e4eff8985419f99b3c1.exe.exe
Filesize8.0MB
MD502f74b67993664fbf0c508d39ec34305
SHA1f96dd7318c5f49fc05aee70f2882895eac0f7c85
SHA256cb8ba69b2fc701433312e1bc73168936f266c5f6cf0ef71be8fc2989a74c5708
SHA512a7d31a38cbf0cfba4973bd6e0f8833defe72beef97d586fa4bbcb5f6790e1e5fb8af0c6d09e91af6ea336540c8040384e2f613db14228279ca8b73c2b80dc057
-
Filesize
39KB
MD5f7ebb3d79ef53cfda9bebd3a4b0e4e0a
SHA13670512f285d65e981e9d7592844c7c42e5d4773
SHA2563c2d6a686dd3a04d7e3413afbe50663a259d1fefa0bb8dfa9568d4c87bf99ef5
SHA512177035a8504c5f1456659715d33968e85b291e44aa89232e96c4c52a2b2156c80f6f5639802241a46d0849f8230c9212d7fc6977b96d5c09440217ba3bad2adb
-
Filesize
9B
MD57619ead719f9163af9f64f79eeff7c36
SHA17b956c82fba1f4a0ea8b09ca2e39d89159e21b75
SHA256da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45
SHA51229dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df