06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
Size

33KB
MD5

0323b99a69386f583bbf4aae937b7b9b
SHA1

c4c2024f4b57285e959f6709d007b9fbac8ab7c4
SHA256

06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1
SHA512

6055a4c8e534622d2257ec2d56c5e751b996c97347296479c2e9590a169bb5c019f03fd34757ba248fa4f337b6484c57b2ddcb08b9f49c996446ef797aef3c4e
SSDEEP

768:O+bjjpQFJFKZj1PVs9Ag1vzbrqaMKJcrsu:O+becx1aeg1v2axu

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\J:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\G:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\Y:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\V:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\S:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\R:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\Q:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\L:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\I:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\E:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\W:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\U:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\T:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\N:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\M:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\K:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\H:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\Z:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\X:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened (read-only)	\??\O:	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Windows Defender\de-DE\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\de-DE\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows Media Player\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Java\jre7\bin\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Windows Defender\es-ES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Windows Journal\it-IT\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
File created	C:\Windows\Dll.dll	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2968	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	28
PID 2896 wrote to memory of 2968	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	28
PID 2896 wrote to memory of 2968	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	28
PID 2896 wrote to memory of 2968	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	28
PID 2968 wrote to memory of 2772	2968	net.exe	30
PID 2968 wrote to memory of 2772	2968	net.exe	30
PID 2968 wrote to memory of 2772	2968	net.exe	30
PID 2968 wrote to memory of 2772	2968	net.exe	30
PID 2896 wrote to memory of 3032	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	31
PID 2896 wrote to memory of 3032	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	31
PID 2896 wrote to memory of 3032	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	31
PID 2896 wrote to memory of 3032	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	31
PID 3032 wrote to memory of 2156	3032	net.exe	33
PID 3032 wrote to memory of 2156	3032	net.exe	33
PID 3032 wrote to memory of 2156	3032	net.exe	33
PID 3032 wrote to memory of 2156	3032	net.exe	33
PID 2896 wrote to memory of 1380	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	21
PID 2896 wrote to memory of 1380	2896	06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
  "C:\Users\Admin\AppData\Local\Temp\06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2772
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7zG.exe

Filesize
601KB

MD5
fb651d34c7c21993eba3ad0dfb231bbd

SHA1
62352d5f48be0cade19fe8f02cb971c8b4860737

SHA256
e0f65ae531d1a4c854390fa44ae74f5a2a386f6329fae873e24901d81650a5b4

SHA512
953b11813c70c3860989134224c4d1e2b720491aea0598681c6a3a5941dd2e0f9ef8b23a9f7d53e76b6ee7bf88fa630c93c9f67d813a1488a97d27803c5ef178

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
70869c207f3a67470417ed76a8cc4735

SHA1
e9e84c30b2cca82e93d507eeace7b33eac862a61

SHA256
0de9fa997f757c78ba0675e7ba54c1e7b1a39c88cebded15b2a0ede357679428

SHA512
193067577ab3f4c7a7798d61b1c0d4a40ef6fabfa4ebf28709d7f226327e9f3f329ed635f83baf5b90eaeabc45df3ae68a7fa247ff0d123df3dd06eee369cfdc

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

Filesize
9B

MD5
588b2065b2adfd8dfd688104d02aad5a

SHA1
263f0ca294d728a13f51220aea8123aa257cc6e2

SHA256
f9ab49edf14c6bda17287f7caa63d3b3bb20a65215f1462cf05577a5c1c472e6

SHA512
99106035ac4547c81fd737f5f79ddd32ea10fde9e3ea97102472c871aa9f94ee3f68823bcc4bb308e92265a9c3cacd4b1f5c9f52f8d3e630cdf6bdcd3c737e2d

Download Submit
memory/1380-3-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2896-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2896-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2896-3254-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2896-4059-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download