Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe
- Size 33KB
- Sample240531-sytypscf4t
- SHA256 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e
- MD5 696135503b001f31cb4cd7844c3e430c
- SHA1 92344ef238d4e3e40fc6e7172d91f58d81bb088a
- SHA512 b0fdf9962a73ce5307fa7283767cc3a6909a02d36ac0776550499c0a81e160917c3e4dd907fa83e617138013107e59dba116f90e3500c13e60f3f0340ebc65ee
- SSDEEP 768:mYBldh+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/BVsrz8VuJlMXaDuiN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\L: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\K: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\J: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\I: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\G: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\E: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\X: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\Q: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\N: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\V: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\W: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\T: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\S: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\P: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\O: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\M: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\Y: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\U: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\H: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened (read-only) \??\Z: 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\Mozilla Firefox\browser\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files\Windows Defender\uk-UA\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe File created C:\Windows\Dll.dll 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3216 wrote to memory of 1504 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 82 PID 3216 wrote to memory of 1504 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 82 PID 3216 wrote to memory of 1504 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 82 PID 1504 wrote to memory of 4820 1504 net.exe 84 PID 1504 wrote to memory of 4820 1504 net.exe 84 PID 1504 wrote to memory of 4820 1504 net.exe 84 PID 3216 wrote to memory of 3776 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 88 PID 3216 wrote to memory of 3776 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 88 PID 3216 wrote to memory of 3776 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 88 PID 3776 wrote to memory of 3940 3776 net.exe 90 PID 3776 wrote to memory of 3940 3776 net.exe 90 PID 3776 wrote to memory of 3940 3776 net.exe 90 PID 3216 wrote to memory of 3572 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 56 PID 3216 wrote to memory of 3572 3216 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe"C:\Users\Admin\AppData\Local\Temp\814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4820
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 68c254e4a94926e48dda2811138fac91afef667c3da61e3838c104fd16397f81
- MD5 716cf04b905e9d25d89e76dd2b521b7a
- SHA1 4464bc7b43656fce19a801c5a77f53027b5748fa
- SHA512 cbebb128990ece59a3d052e5d6edfc8bacf33d74aad72f31bd6a98a91194088a5d9a460ac8000fec4cedbe019dc6bfca38912832be0e151bcd2e1f4984b4e578
- SSDEEP 6144:3G5KFgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:3PSitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 48KB
- SHA256 0aa3a52b2cbb61c275eb990123dd78e1d1334b098adf93a919e856ff8dbe957b
- MD5 3f22fddb325a0a9243dda414bd9f2497
- SHA1 2fdb8785724fd9312c4859b9bf908dcede4b1309
- SHA512 6c690ba78e03c1cb0ae5195a57567ba02bacf055a0043c48408fa8e89c0eb35ccfbaf5c904a6af0068ce95e6dcfb3ed661d14baa00a06b103bcf65e80e938f9f
- SSDEEP 768:mYBldh+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN/WQ3655Kv1X/qY1MSd:/BVsrz8VuJlMXaDuiNBHqaNrFd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 644KB
- SHA256 f168cda7cfa0f4f1d8dc26f615772410afe41b43fbc3da3cfe2c249b1eadca30
- MD5 11e0853d537d2721ecc655c1fc527e91
- SHA1 c8e23d103e93073ba7c93374878ae9a9f926c944
- SHA512 3e5af85789e480d355053e9ded02108ae53136aec795d5d37faf1d5426275f7f3729e5583b0a95b3434d5b4452c7382405c0f8bc94e8a65275335c62268e0ee2
- SSDEEP 12288:gBPh5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:IPh5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-1162180587-977231257-2194346871-1000\_desktop.ini
- Size 9B
- SHA256 8f1b205bcc3039e60fbcea0063608e012fd662abb41bba5469d530e2c305174d
- MD5 0e9e05c07df1bfb27555d84deb706050
- SHA1 48ebafcf728d66a097bc66ad41b73d7a757c1a0c
- SHA512 d88c9a9bdf6f386278ba86cf3523334eeb5e9efefa9776bc92bdffa41f0c4937e64a7b5f3821b324e13372fa662aa4fb028676f7ed0a73c989edabd490bd05f5
- MD5 SHA1 SHA512