6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
Size

33KB
MD5

522328a63deefd58df4a5c342b18d3a3
SHA1

0574e197a7f9c3c4314c86604ff9247f85718a1d
SHA256

6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a
SHA512

30dddf759bc229be19068fdc916388d2e96568edec6e67f1ed767562498831707dbcd114fca750da6bf8ab7eaba10b8b92707c6a6cad622c99756ca1b48c9145
SSDEEP

768:mYBPLQh+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/Bqsrz8VuJlMXaDuiN

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\X:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\U:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\R:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\P:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\L:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\E:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\Z:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\T:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\S:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\M:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\K:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\J:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\W:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\Q:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\O:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\H:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\V:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\I:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\G:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened (read-only)	\??\N:	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Windows Mail\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Internet Explorer\de-DE\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Windows Media Player\it-IT\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\chrome_installer.exe	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Google\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
File created	C:\Windows\Dll.dll	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2040	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	28
PID 1192 wrote to memory of 2040	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	28
PID 1192 wrote to memory of 2040	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	28
PID 1192 wrote to memory of 2040	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	28
PID 2040 wrote to memory of 2880	2040	net.exe	30
PID 2040 wrote to memory of 2880	2040	net.exe	30
PID 2040 wrote to memory of 2880	2040	net.exe	30
PID 2040 wrote to memory of 2880	2040	net.exe	30
PID 1192 wrote to memory of 2920	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	31
PID 1192 wrote to memory of 2920	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	31
PID 1192 wrote to memory of 2920	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	31
PID 1192 wrote to memory of 2920	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	31
PID 2920 wrote to memory of 2580	2920	net.exe	33
PID 2920 wrote to memory of 2580	2920	net.exe	33
PID 2920 wrote to memory of 2580	2920	net.exe	33
PID 2920 wrote to memory of 2580	2920	net.exe	33
PID 1192 wrote to memory of 1200	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	21
PID 1192 wrote to memory of 1200	1192	6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe
  "C:\Users\Admin\AppData\Local\Temp\6f2f3351e5a9f8113f36db38b56318faa848defdf733948cc636e18c0cefc06a.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2880
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
2e2680954b6907c2c067b143837bdb5c

SHA1
a8d99eb46a787e24b4b530be0e4c1a9756e48bbb

SHA256
708b327ea58dd84066404b37641d892bfa4593ba408651d947a8ad4406b635a6

SHA512
82563536b862cc901478c0d22c0783622b74d7cae8f0763dd1b9eb0b62713929bad122b88403283ffbab0194f55ba655e84ed800ce80f5945135538c1a59de7e

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
717KB

MD5
3e4f8da8d4b5253b2b17bb6a4fb7dc21

SHA1
69dfa45cb1118c6a3331b4e5181cfa0614d07b74

SHA256
32e881a6b2ba48cff258d2cdb25c92b8fe0450b5d5959be43692e7007a336630

SHA512
b6e21f4ac195985e464d7162e17ec47caeb0e940017529958a5eb58083ae9080f0772ab2018daf21114cf3a0918fe26972c751603aeda64dd97c90f721b6e53e

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
5264aab343fc1f53c29d1065346d0010

SHA1
db43bc0b28b4ada0c5635db50fd0b64410ab76ad

SHA256
d33d56847b353c8207a43aa01cc75527328ebf4bba669e90e29266d1b6fb57dd

SHA512
bb4ba1f7c5cae56cef564dd99f1a1fd3e2c656f8004f689a22ea641d886cbb3a19dde3dce5be4cf8cee4ce190170fd8c5390cb9c7c40ae54109559685119a958

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\_desktop.ini

Filesize
9B

MD5
0e9e05c07df1bfb27555d84deb706050

SHA1
48ebafcf728d66a097bc66ad41b73d7a757c1a0c

SHA256
8f1b205bcc3039e60fbcea0063608e012fd662abb41bba5469d530e2c305174d

SHA512
d88c9a9bdf6f386278ba86cf3523334eeb5e9efefa9776bc92bdffa41f0c4937e64a7b5f3821b324e13372fa662aa4fb028676f7ed0a73c989edabd490bd05f5

Download Submit
memory/1192-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1192-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1192-3318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1192-4148-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1200-3-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download