Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 15:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
- Target 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe
- Size 11.1MB
- Sample240527-skab5she98
- SHA256 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab
- MD5 92693294be264a7d07b256265366b1b1
- SHA1 b27aa29b593f61d1f36c506063190bd117f24a2f
- SHA512 0ca38be30afd18ca83fef915b2359d779a387491b2f0e69ac26128d7cc1348302e526ffa3d3137170cb47dcd92d3567ac8d30dd209b4eb649fcec392feedd5f9
- SSDEEP 98304:Nb+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9Y:9+kIGv3y/x+KTbfjJ+kdnAlejY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 4732 Logo1_.exe 2860 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3112 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe File created C:\Windows\Logo1_.exe 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe 4732 Logo1_.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2860 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3764 wrote to memory of 1616 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 81 PID 3764 wrote to memory of 1616 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 81 PID 3764 wrote to memory of 1616 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 81 PID 1616 wrote to memory of 2364 1616 net.exe 83 PID 1616 wrote to memory of 2364 1616 net.exe 83 PID 1616 wrote to memory of 2364 1616 net.exe 83 PID 3764 wrote to memory of 3696 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 87 PID 3764 wrote to memory of 3696 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 87 PID 3764 wrote to memory of 3696 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 87 PID 3764 wrote to memory of 4732 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 88 PID 3764 wrote to memory of 4732 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 88 PID 3764 wrote to memory of 4732 3764 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 88 PID 4732 wrote to memory of 3968 4732 Logo1_.exe 89 PID 4732 wrote to memory of 3968 4732 Logo1_.exe 89 PID 4732 wrote to memory of 3968 4732 Logo1_.exe 89 PID 3968 wrote to memory of 3836 3968 net.exe 92 PID 3968 wrote to memory of 3836 3968 net.exe 92 PID 3968 wrote to memory of 3836 3968 net.exe 92 PID 3696 wrote to memory of 2860 3696 cmd.exe 94 PID 3696 wrote to memory of 2860 3696 cmd.exe 94 PID 2860 wrote to memory of 3112 2860 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 95 PID 2860 wrote to memory of 3112 2860 7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe 95 PID 4732 wrote to memory of 3412 4732 Logo1_.exe 96 PID 4732 wrote to memory of 3412 4732 Logo1_.exe 96 PID 4732 wrote to memory of 3412 4732 Logo1_.exe 96 PID 3412 wrote to memory of 2980 3412 net.exe 98 PID 3412 wrote to memory of 2980 3412 net.exe 98 PID 3412 wrote to memory of 2980 3412 net.exe 98 PID 4732 wrote to memory of 3452 4732 Logo1_.exe 56 PID 4732 wrote to memory of 3452 4732 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe"C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D4A.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe"C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe"C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe" --type=collab-renderer --proc=28605⤵
- Executes dropped EXE
PID:3112
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3836
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2980
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 666ca0e926bc557503309ada0633c33844d0feb048c815c503f381a0bf6ebddc
- MD5 f44aac5207fae774b320093a814fe8ce
- SHA1 836a7d71f3853f69ea12919a7d5289fac24cb241
- SHA512 ae387ac2a8dc838c30cb1869eca33c63d4a0a03d0e6d20ffe65650846abf55fe18d22599cd94747595ceaa27b802d3505230c4a0469cabd3037ee761215aa500
- SSDEEP 6144:n1qe1ISsgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:n1quI4itXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 07481182a1f0952663948dc601a4532f1ed257cb853bc032c0557173040e995c
- MD5 0e6d500107143697bcfba9450bc17c82
- SHA1 f54f6251aa1f02777459466a0311ac093b2af7ef
- SHA512 6abb4b37772a348cec7cef9ee5d44b8bc0ebbce167029a2da2d6547df202315c3c334580d4ca26f36bc820d8d967dd8b987f791869090cfe60ac19a6bd38fbc2
- SSDEEP 6144:U1qe1ISNE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BE:U1quIh7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 643KB
- SHA256 10579b661dade8697f252204f241952eb2029ea6978165f9336fd60a72b3205e
- MD5 9363a720e098b38389b25a7b18cfbcdd
- SHA1 7b5e835b22262b47e6042e7aadecc67dac05f7db
- SHA512 564b873358ebe4d4d194b924e9934cb5c1666df901db2556e8cbab8276f8c4380a5bee157cc8eb2063fe0f48a1d0dc1cf339d3d3040d764c974e1c46b0870f88
- SSDEEP 12288:kt1quIv5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:U1qx5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a2D4A.bat
- Size 722B
- SHA256 e0cfdfb6b8a2503039f813571f305e4ebef134ce969fda8bfda3898b5b50db77
- MD5 55dd89e162583952255065e3f9176dd0
- SHA1 43b81a744df8037ac21b0554663814dcf05c7a8d
- SHA512 7ea49c097b2892318681b6b119f4f86512b868411886ce71cf93b75baa2c174545a22b72c0e96ec000236a3b7c4b7a9d2495f98be6368bb3633f4fb7672615ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7e8acb7323dc4174010826f62755e29769e07e9aceb1eceeee17dcb2cca253ab.exe.exe
- Size 11.0MB
- SHA256 5f1d9218f9735a763ffecc47c7b6f0c342b7f1a5da835733e0b3b73903f864a0
- MD5 b45b7bd6eb92c5b65378d8d0a0964747
- SHA1 5ca6f198ac83c90496110259b57ff4a5f47b64bb
- SHA512 bde39c4b6d04caae8280bdd53e6036c53ed394a72f0d4d1273c149175570e8a87f87c8963869c96834fef7e82893da38c49ce4aaa1851e65c055dbbcac7c1708
- SSDEEP 98304:Db+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9Y:n+kIGv3y/x+KTbfjJ+kdnAlejY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 3e02caf1f845080b75cf865164adfa1c4855d5b6cab6af1664a97c37f3bab646
- MD5 f5a21d2ae39e85a9b986aa3060965b87
- SHA1 b22d04580bfbcbc846d18f96ba92018cb1a8138a
- SHA512 e0bfbe521ca648fe2dabe227235e758d5663c8573440df8b9217f033cb005aaa7b802f7ad9d85bbedaef0ce73503f7a82923623d25483d4d665b0495fcfd5c6f
- SSDEEP 768:FVSTRgpQFJFKZj1PVs9Ag1vzbExhU1GBRSkji:FITncx1aeg1vye1MRS
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
- Size 9B
- SHA256 968b715c081472526487d60da8968e9b3bde2dac103f69beb3f6abe6ef7bc191
- MD5 fa1e1ef0fdda97877a13339b28fa95e5
- SHA1 7e2cffca41118e7b2d62963bd940630b15b85653
- SHA512 3d55913a97aa89a7201342705640c1d031d19ad8aca4939219067f84e3fe118f47b4e388f490f69f605683d3854425c3de188f731886405474ae8e3d42c86f4f
- MD5 SHA1 SHA512