Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
-
Size
33KB
-
MD5
0323b99a69386f583bbf4aae937b7b9b
-
SHA1
c4c2024f4b57285e959f6709d007b9fbac8ab7c4
-
SHA256
06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1
-
SHA512
6055a4c8e534622d2257ec2d56c5e751b996c97347296479c2e9590a169bb5c019f03fd34757ba248fa4f337b6484c57b2ddcb08b9f49c996446ef797aef3c4e
-
SSDEEP
768:O+bjjpQFJFKZj1PVs9Ag1vzbrqaMKJcrsu:O+becx1aeg1v2axu
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\Q: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\M: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\X: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\Y: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\V: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\S: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\P: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\K: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\Z: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\N: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\L: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\H: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\E: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\U: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\T: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\O: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\J: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\I: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\G: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened (read-only) \??\W: 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\Microsoft Office\PackageManifests\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\Microsoft Office\root\fre\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ar-ae\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\_desktop.ini 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe File created C:\Windows\Dll.dll 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4132 wrote to memory of 1560 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 83 PID 4132 wrote to memory of 1560 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 83 PID 4132 wrote to memory of 1560 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 83 PID 1560 wrote to memory of 3980 1560 net.exe 85 PID 1560 wrote to memory of 3980 1560 net.exe 85 PID 1560 wrote to memory of 3980 1560 net.exe 85 PID 4132 wrote to memory of 3136 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 89 PID 4132 wrote to memory of 3136 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 89 PID 4132 wrote to memory of 3136 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 89 PID 3136 wrote to memory of 1820 3136 net.exe 91 PID 3136 wrote to memory of 1820 3136 net.exe 91 PID 3136 wrote to memory of 1820 3136 net.exe 91 PID 4132 wrote to memory of 3436 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 56 PID 4132 wrote to memory of 3436 4132 06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe"C:\Users\Admin\AppData\Local\Temp\06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3980
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1820
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5f2751b0158447769335cebe34c2d82d9
SHA19d413b52a50071f39ef72635f1365fd237d44d84
SHA2567525f335f9b13f85df57c421fca09cd644fdbba67a79916e784417f30de15f5c
SHA512b0c3b79073ff4f5ef88c48b026ad396f476daf5d51291ce9932bf7005cec3d2d52d38f9b17f956ee42a731f964b3bd400549a8be2b1760bec82e61c0a6b5aa0b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5b489893e2a89eb1682d618b8824fb7c3
SHA18f929e84ce714a7247920ec3902292e977ebb26d
SHA256720afba2de160448f339c299f4607089254ec8f82168694d7808273128822e81
SHA512a6f03b3cd792ad476e69854adc6280898882379bba50bab0af36d718d5b6806b585f172024f99a4f282785b9759ad3383643c9283daaa5947b79e8102d2c90c1
-
Filesize
9B
MD5588b2065b2adfd8dfd688104d02aad5a
SHA1263f0ca294d728a13f51220aea8123aa257cc6e2
SHA256f9ab49edf14c6bda17287f7caa63d3b3bb20a65215f1462cf05577a5c1c472e6
SHA51299106035ac4547c81fd737f5f79ddd32ea10fde9e3ea97102472c871aa9f94ee3f68823bcc4bb308e92265a9c3cacd4b1f5c9f52f8d3e630cdf6bdcd3c737e2d