Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
General
- Target 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe
- Size 666KB
- Sample240531-s25jlsdd87
- SHA256 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d
- MD5 955f4c4ca1ce4bab1691f005f977c9d3
- SHA1 be66b0798725a9a42f34275faa7ba89b0791dbd0
- SHA512 ec51d9bdb9149d9c95728dc4ca3d7c0e85d23fd7b165078e45a7cce04df3b5b90ac07dbf46c6993fa622d5baf600d927c7f48f4d4807d005f6e325ddec8d3e1c
- SSDEEP 6144:t+aMWC9LRU0ySj14WH+JPb7uL8zRMnJjNhAp7SO8zRMnJjNhAp7S8FRcdEKFVAh7:t+aMbPFlTz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 3812 Logo1_.exe 4756 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe 3812 Logo1_.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4844 wrote to memory of 448 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 91 PID 4844 wrote to memory of 448 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 91 PID 4844 wrote to memory of 448 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 91 PID 448 wrote to memory of 3128 448 net.exe 93 PID 448 wrote to memory of 3128 448 net.exe 93 PID 448 wrote to memory of 3128 448 net.exe 93 PID 4844 wrote to memory of 1812 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 94 PID 4844 wrote to memory of 1812 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 94 PID 4844 wrote to memory of 1812 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 94 PID 4844 wrote to memory of 3812 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 96 PID 4844 wrote to memory of 3812 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 96 PID 4844 wrote to memory of 3812 4844 1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe 96 PID 3812 wrote to memory of 2128 3812 Logo1_.exe 97 PID 3812 wrote to memory of 2128 3812 Logo1_.exe 97 PID 3812 wrote to memory of 2128 3812 Logo1_.exe 97 PID 1812 wrote to memory of 4756 1812 cmd.exe 99 PID 1812 wrote to memory of 4756 1812 cmd.exe 99 PID 2128 wrote to memory of 2248 2128 net.exe 100 PID 2128 wrote to memory of 2248 2128 net.exe 100 PID 2128 wrote to memory of 2248 2128 net.exe 100 PID 3812 wrote to memory of 4432 3812 Logo1_.exe 101 PID 3812 wrote to memory of 4432 3812 Logo1_.exe 101 PID 3812 wrote to memory of 4432 3812 Logo1_.exe 101 PID 4432 wrote to memory of 3192 4432 net.exe 103 PID 4432 wrote to memory of 3192 4432 net.exe 103 PID 4432 wrote to memory of 3192 4432 net.exe 103 PID 3812 wrote to memory of 3428 3812 Logo1_.exe 56 PID 3812 wrote to memory of 3428 3812 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe"C:\Users\Admin\AppData\Local\Temp\1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3128
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3350.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe"C:\Users\Admin\AppData\Local\Temp\1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe"4⤵
- Executes dropped EXE
PID:4756
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2248
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3192
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:4124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\UpdateResolve.exe
- Size 223KB
- SHA256 2274aa96593da37ee081d6fb770a18f600c3f69fca57c3177a3a2061bbdd421b
- MD5 0865cbd3a3ef25d9a0e5a327649b81ff
- SHA1 85d0355404da132c3ef7fe307b8b94361d3e802e
- SHA512 c0fb75b7bba51f4ce77945f992264411843fa8577d731b98005966a80b8b305b695a4f0a674c82caa6305108bd0d5c6658c683e02ca1c10380b19c864fbaba78
- SSDEEP 6144:t+aMf7SOWmG4KQcTwwy3C0QScN2Niq8nk+K2Lkn:t+aMTSOWmG4KKZakn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 488KB
- SHA256 98ef7492272a218a50165d981a4a1395b9805072bcf197339e5f920b38c60962
- MD5 5edf853f75f2fe46d563279278313cfd
- SHA1 5ff4a328e4b6c6e0cf167d571992696d51f64bcf
- SHA512 dfac350926ee9c01e4fe36b03e7d969c8426bc8e1be72256098f66812052855677873e1c76d15a79083e7072178d3234c7db0d0aeab3e7346c21a0f61482db24
- SSDEEP 12288:+T+aMBqIOkU8AMXE9B7PElZlP41N+4PUWfo:EBwBOkUhMXcBwc04nA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a3350.bat
- Size 722B
- SHA256 bf53165e44d6db3a6c1e4e103522bedd95031d2a18436e7a3fc583ede3cb5e6b
- MD5 93613f7264f759cddb638442a10ea90c
- SHA1 5d3e178f0c810564cd991d992056606d5c9d6eca
- SHA512 99997709f81d04873bbd2060ec7f13acbbe74af656bd28068119c45786b133e23e3734d8540d1a3f305e0db65d1e0394fb3f0f170c673248850295bcae93ded6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1ada4bd3a27f8ad13544e8a9a8c8da56124ad0f78f5ff0af700abff6fad07c7d.exe.exe
- Size 633KB
- SHA256 cb83f04591cc1d602e650dd5c12f4470cf21b04328477bd6a52081f37c04bd7c
- MD5 2e0d056ad62b6ef87a091003714fd512
- SHA1 73150bddb5671c36413d9fbc94a668f132a2edc5
- SHA512 b8e920f8b7547aec6f5771e3e6119b01157e5e36a92c67142b0d73ffe0d501d933581e1fc752e5bba9ce819e3897be9c146bebfc0018e91318b0c99d188a2580
- SSDEEP 6144:iC9LRU0ySj14WH+JPb7uL8zRMnJjNhAp7SO8zRMnJjNhAp7S8FRcdEKFVAh7cASu:3PFlTz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 c771274939a5550080acaa8e6f67019e5fa81ac8a4715e1011aabf475e93db80
- MD5 1a18d01331e20dcee8c80ba2127f8da7
- SHA1 37c41c26759e13ba7aa34c4409ec352dabc6b72d
- SHA512 eef48075814744a7e9e7f3e47d91dacfdf877d54a2952a0a8bf07d108f58020ff960c9dc76ef5f33c89a6cf53f30e935e6460d8023482dec5ea230ebbec0e39b
- SSDEEP 768:/pPcTO5RroZJ76739sBWsNscWlM3dN9N3ZjfPP:/lSe+Zk78NR3dN5nP
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini
- Size 9B
- SHA256 8f1b205bcc3039e60fbcea0063608e012fd662abb41bba5469d530e2c305174d
- MD5 0e9e05c07df1bfb27555d84deb706050
- SHA1 48ebafcf728d66a097bc66ad41b73d7a757c1a0c
- SHA512 d88c9a9bdf6f386278ba86cf3523334eeb5e9efefa9776bc92bdffa41f0c4937e64a7b5f3821b324e13372fa662aa4fb028676f7ed0a73c989edabd490bd05f5
- MD5 SHA1 SHA512