Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
General
-
Target
ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe
-
Size
3.1MB
-
MD5
934653db91427eb38c5ae7d1fab765b1
-
SHA1
a6b017fa1c95a6fb982c0f6a26079195688f45d6
-
SHA256
ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60
-
SHA512
cd880fb0057b2d012d53bb98f17f052c45c9365c3744cac702cfd10f89c91074b4ab8fcb6f3463a325ff90dc2e055c91716b9deee8b7c4a879b79fa2908e66c0
-
SSDEEP
49152:ydRI8boQhfD6UDvxvykXk1rBsgyegFKvc4clwY:ydDDm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4840 Logo1_.exe 5080 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe File created C:\Windows\Logo1_.exe ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5080 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4520 wrote to memory of 3480 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 82 PID 4520 wrote to memory of 3480 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 82 PID 4520 wrote to memory of 3480 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 82 PID 3480 wrote to memory of 2012 3480 net.exe 84 PID 3480 wrote to memory of 2012 3480 net.exe 84 PID 3480 wrote to memory of 2012 3480 net.exe 84 PID 4520 wrote to memory of 3552 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 88 PID 4520 wrote to memory of 3552 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 88 PID 4520 wrote to memory of 3552 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 88 PID 4520 wrote to memory of 4840 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 89 PID 4520 wrote to memory of 4840 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 89 PID 4520 wrote to memory of 4840 4520 ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe 89 PID 4840 wrote to memory of 1912 4840 Logo1_.exe 91 PID 4840 wrote to memory of 1912 4840 Logo1_.exe 91 PID 4840 wrote to memory of 1912 4840 Logo1_.exe 91 PID 3552 wrote to memory of 5080 3552 cmd.exe 93 PID 3552 wrote to memory of 5080 3552 cmd.exe 93 PID 1912 wrote to memory of 2120 1912 net.exe 94 PID 1912 wrote to memory of 2120 1912 net.exe 94 PID 1912 wrote to memory of 2120 1912 net.exe 94 PID 4840 wrote to memory of 2220 4840 Logo1_.exe 96 PID 4840 wrote to memory of 2220 4840 Logo1_.exe 96 PID 4840 wrote to memory of 2220 4840 Logo1_.exe 96 PID 2220 wrote to memory of 1188 2220 net.exe 98 PID 2220 wrote to memory of 1188 2220 net.exe 98 PID 2220 wrote to memory of 1188 2220 net.exe 98 PID 4840 wrote to memory of 3492 4840 Logo1_.exe 56 PID 4840 wrote to memory of 3492 4840 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe"C:\Users\Admin\AppData\Local\Temp\ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a414F.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe"C:\Users\Admin\AppData\Local\Temp\ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5080
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2120
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1188
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD53abe1cbfd0debb68fe3c2d4f99c608ec
SHA1029614f3948dfe6b6ffaffe8bce1cafbf9417f9d
SHA2563852af8ebfaea778190bb692f270499f767cc0a114bd69eb69dd348b9ed1b0eb
SHA5121be2efd9731051729e71758f01436f7b7475f62efdd1a48b776f461dab176b64df3c66c393737b0c0496707542d08e762682a5b92d78f1f4649e84258a668a57
-
Filesize
577KB
MD5582795a0494288fd7561e5b71a348a3c
SHA15b25e56a6159787081a3a4f6a17adeb7778a0caf
SHA2568bc2d99c53992d811567b98cd20e70941dd4d9351b71f03a18450d3fc78b88cd
SHA51269843624a507a7ce886e5fe66d704413847950ffca8bbbf818697b0a66cf3ff561a8e075e709f6da3ad1ff1820ee44b808e38157f8c8f37936a7a19f9ca8a331
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5635e9422a0a86f5c7ac989802b0ac448
SHA13ea9cc1462b063639526a8d278b571f38b846d1d
SHA256a97d8545a6204abf1a179f2098ca8780e92f4448c7a03e62f6c32e8e5e5cb17f
SHA512857c6d683fe1f7a6757420c84efc4f7f48f58e586e601c969ce27e4ded8cad6ca774ef367a1a1e075081c4e2d41f8cdda558fddf5622e062975cfeff5a929133
-
Filesize
722B
MD5182ff1b8b27a5d620774a488d116a6ec
SHA1c414150d2d1b8c93a025ac53150df6372a1c9603
SHA2565afed892ab829aacde7e15477a7168f4208b5906ce52159ef60947ff3646b388
SHA512efc0ec61c7600cf67f9c66a96b88a1f49b859842d1a64207e81acdc9d06863945bedfd006231c0dedff41f97b04ff71a48bdcd5f2da76b33cd575db195d222f8
-
C:\Users\Admin\AppData\Local\Temp\ec1d9b03a0c9ae49490589d2ae295f118b34b2f6e42c6b9a4d64ed1e728cdf60.exe.exe
Filesize3.0MB
MD507dd9dcd1cc2840751a1f8772f3c0195
SHA1c6203a3990cfbf396ae87110e341f773cd6be4c1
SHA2569b39147e1ba781ea8e463c22700f6ce354ac5e775e36657fd87bf41074835602
SHA5125e547dc18a2b44a6dd67f6b43ee5b5b1bbd4ec1e8b5507b0d990837a7adb72b66808e7487f97062d54e4d3c2c7b791e3b580c9ed316e9d003849f7a6f6a3d56b
-
Filesize
33KB
MD5e566cc2bee05cd120e02caaa3c08df55
SHA1dbb9f693919d0ca109f532ab4ddfcb5769635b18
SHA2565dda0cc34970e4a60d14a0775b925153d046b4aa80068f6f2918eef1bc3d2c78
SHA512f88c382cfcd0bd6770824b9f6c50b87c6940925daf197ba37ead13544bc91ac322afdc3407f04de40c89ea6b89c308247aca61ca97f9f0fb2122589e71d97662
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD5e850d9ceb7ebcc619d731dc2f1377b2b
SHA1a45553c9057075c02e28f90d5e8ea57a0dddbacc
SHA256b682a6e85069777ca22f84b99607acd09640eaa80029d74363c0a5aabddead4c
SHA512be92bd8393d0fe69559ec55e1068fcd77ccc699361a9cb98d467bd51a029c371852b7a1196ad53fa8865e956582e6a4d35f6ac6fea3832058b7a427133b0048c