Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 19:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
General
-
Target
8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe
-
Size
964KB
-
MD5
79fd752e35dad497f11d444435a2f0a1
-
SHA1
d3618a763732264529d2bfa11841f489e7b0175b
-
SHA256
8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61
-
SHA512
a2204a783f5cde1f811e4a9318e132a6d294692895439051ad2894bc3800f9e78839fa21a2c6c048cd399f407adefe9bbe5dc987d750dfb97eca5bbc7c4b213b
-
SSDEEP
12288:u3NURKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:u3N5BpDRmi78gkPXlyo0G/jr
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1348 Logo1_.exe 5232 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Multimedia Platform\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe File created C:\Windows\Logo1_.exe 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe 1348 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5232 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe Token: 35 5232 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4844 wrote to memory of 4976 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 81 PID 4844 wrote to memory of 4976 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 81 PID 4844 wrote to memory of 4976 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 81 PID 4976 wrote to memory of 1396 4976 net.exe 83 PID 4976 wrote to memory of 1396 4976 net.exe 83 PID 4976 wrote to memory of 1396 4976 net.exe 83 PID 4844 wrote to memory of 3560 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 87 PID 4844 wrote to memory of 3560 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 87 PID 4844 wrote to memory of 3560 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 87 PID 4844 wrote to memory of 1348 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 88 PID 4844 wrote to memory of 1348 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 88 PID 4844 wrote to memory of 1348 4844 8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe 88 PID 1348 wrote to memory of 4044 1348 Logo1_.exe 90 PID 1348 wrote to memory of 4044 1348 Logo1_.exe 90 PID 1348 wrote to memory of 4044 1348 Logo1_.exe 90 PID 4044 wrote to memory of 5480 4044 net.exe 92 PID 4044 wrote to memory of 5480 4044 net.exe 92 PID 4044 wrote to memory of 5480 4044 net.exe 92 PID 3560 wrote to memory of 5232 3560 cmd.exe 93 PID 3560 wrote to memory of 5232 3560 cmd.exe 93 PID 1348 wrote to memory of 4680 1348 Logo1_.exe 94 PID 1348 wrote to memory of 4680 1348 Logo1_.exe 94 PID 1348 wrote to memory of 4680 1348 Logo1_.exe 94 PID 4680 wrote to memory of 5220 4680 net.exe 96 PID 4680 wrote to memory of 5220 4680 net.exe 96 PID 4680 wrote to memory of 5220 4680 net.exe 96 PID 1348 wrote to memory of 3472 1348 Logo1_.exe 56 PID 1348 wrote to memory of 3472 1348 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe"C:\Users\Admin\AppData\Local\Temp\8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a376B.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe"C:\Users\Admin\AppData\Local\Temp\8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5232
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5480
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5220
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD552d15efffac87e5af874aaf4de7c2e85
SHA1d13a2ff2252f33b5da04577c28296e65b2f7a969
SHA2565c088c41f815706737b4e504775489caacf902137e95f334070f7a9573093e81
SHA512a470238c957edd579daf2c7a605831bfa6966c03ec697ca06cca5502909aa6744e2de56e4c2712f0f2c3412982d61a42718ef0cb2e88c0e0d7dc74741084fb6c
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD57336494852e3caadfcce5366c9fd96b0
SHA1c0b1238afa2a7356ca97eabd08300a280d036c38
SHA256a163e93fb197b7dd6f294848c0e858be8ccca9c3ee1a5d1ffefac937b2c8c220
SHA512ee4bf404355c5c5ed2e7823442c034a104dc37238ce46d83c4333bab36d0edd30b91bb1e3c1d93bb56a003637df820a20f772ac114efa78034739752fc3047c0
-
Filesize
722B
MD5325b187ac5adc5d9e87d5a042b5e970e
SHA171434fe4bb3337f36669c9fdae0559d13cc2bca4
SHA256369852868779f15bb608b62ecc30b30fd4c061c918f1d6ff16b44bf3bef3ffdf
SHA512f41f986372c2d71f10620fb1111d0e0b2127aa17f9e736b01bf8cb92c10256174d5e83cb0674d7f9a50441424ed6171b25e3debbb81705627d7650d1206db7a8
-
C:\Users\Admin\AppData\Local\Temp\8fc256f2396a8b13fe2a2651f2afe0fdd967f5d3d71503e4c86f54f17b892d61.exe.exe
Filesize930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
33KB
MD50152b1b1af674e2fbdeb37b47352155d
SHA16c38da1c0284af4d84e3dbf54eaca1b438d66e11
SHA256d48f69c1dca4b41e3053a6e6bc7c10a5233bbf7113bda9b171a1f82d3ad574f9
SHA512385b0dc642b9b94fbbb87a8cbb2b00d305e1e73657a953d75ac1d5d6831e9e4556201b2a88c21dad8a0ae4b8c9edf83bb01acbb1b26ab5e33dedb6c97ea12434
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD502e4d47cbb9cf2affe1a6d96af753a42
SHA1fe76259bc3376a8aa287867933c6bfd7fdae1944
SHA2568079d35a07b892f00cdffeed754377382353a6e5870c06c02dc8dbaf809d291a
SHA512cc47f23bb8b014458285ee912566350c0d09c49d9e40666790694b4d4d7961abbf7adcf9d54e78571a3b97d27a05c58f3db3fdaaa3f4221130a248ed780a1746