Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
General
-
Target
26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe
-
Size
491KB
-
MD5
e2ea0a748c5ecacc2f7203fe3aa362c8
-
SHA1
aa4a2b3ebcade94ebef84601544c1abe94fa3bbc
-
SHA256
26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23
-
SHA512
85b095a4178ec7d9aab2ba14deecd2b250d60a29443d05fe7d5c0a214a4752cb534a8ee04dfedc2e1d91bdd7b399ef6e227881644acfbecd552697bcf6b646fc
-
SSDEEP
6144:u46tGdyPz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fa2:u3Nb1gL5pRTcAkS/3hzN8qE43fm78V
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3420 Logo1_.exe 4840 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe File created C:\Windows\Logo1_.exe 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe 3420 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 912 wrote to memory of 1052 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 83 PID 912 wrote to memory of 1052 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 83 PID 912 wrote to memory of 1052 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 83 PID 1052 wrote to memory of 4712 1052 net.exe 85 PID 1052 wrote to memory of 4712 1052 net.exe 85 PID 1052 wrote to memory of 4712 1052 net.exe 85 PID 912 wrote to memory of 4984 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 89 PID 912 wrote to memory of 4984 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 89 PID 912 wrote to memory of 4984 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 89 PID 912 wrote to memory of 3420 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 90 PID 912 wrote to memory of 3420 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 90 PID 912 wrote to memory of 3420 912 26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe 90 PID 3420 wrote to memory of 3188 3420 Logo1_.exe 91 PID 3420 wrote to memory of 3188 3420 Logo1_.exe 91 PID 3420 wrote to memory of 3188 3420 Logo1_.exe 91 PID 3188 wrote to memory of 4812 3188 net.exe 93 PID 3188 wrote to memory of 4812 3188 net.exe 93 PID 3188 wrote to memory of 4812 3188 net.exe 93 PID 4984 wrote to memory of 4840 4984 cmd.exe 95 PID 4984 wrote to memory of 4840 4984 cmd.exe 95 PID 3420 wrote to memory of 4764 3420 Logo1_.exe 97 PID 3420 wrote to memory of 4764 3420 Logo1_.exe 97 PID 3420 wrote to memory of 4764 3420 Logo1_.exe 97 PID 4764 wrote to memory of 704 4764 net.exe 99 PID 4764 wrote to memory of 704 4764 net.exe 99 PID 4764 wrote to memory of 704 4764 net.exe 99 PID 3420 wrote to memory of 3500 3420 Logo1_.exe 56 PID 3420 wrote to memory of 3500 3420 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe"C:\Users\Admin\AppData\Local\Temp\26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4640.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe"C:\Users\Admin\AppData\Local\Temp\26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe"4⤵
- Executes dropped EXE
PID:4840
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4812
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:704
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD552d15efffac87e5af874aaf4de7c2e85
SHA1d13a2ff2252f33b5da04577c28296e65b2f7a969
SHA2565c088c41f815706737b4e504775489caacf902137e95f334070f7a9573093e81
SHA512a470238c957edd579daf2c7a605831bfa6966c03ec697ca06cca5502909aa6744e2de56e4c2712f0f2c3412982d61a42718ef0cb2e88c0e0d7dc74741084fb6c
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD57336494852e3caadfcce5366c9fd96b0
SHA1c0b1238afa2a7356ca97eabd08300a280d036c38
SHA256a163e93fb197b7dd6f294848c0e858be8ccca9c3ee1a5d1ffefac937b2c8c220
SHA512ee4bf404355c5c5ed2e7823442c034a104dc37238ce46d83c4333bab36d0edd30b91bb1e3c1d93bb56a003637df820a20f772ac114efa78034739752fc3047c0
-
Filesize
722B
MD5441da094a35ff5b5218881e152251a40
SHA11564ea1d6a162741e7ad9f75c2bee4f4bd589ce0
SHA2563a56d45b124620760b9c41200e599494ab7623bde58cd65d6c8a556b978a8e30
SHA5129bd4201ebf4a7134dc1e21e86ad870bce9675b6d110d0635d7d64e47dcd6ad6bd93fc25334852aad8e430a1b4f1ed7a0e2d09686b5b8a065340cb56bdb52cf5f
-
C:\Users\Admin\AppData\Local\Temp\26e4350a2bdbf3beb4a69124a95e388740c1422b09eaba4e55065f3a1dfcbe23.exe.exe
Filesize458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
33KB
MD50152b1b1af674e2fbdeb37b47352155d
SHA16c38da1c0284af4d84e3dbf54eaca1b438d66e11
SHA256d48f69c1dca4b41e3053a6e6bc7c10a5233bbf7113bda9b171a1f82d3ad574f9
SHA512385b0dc642b9b94fbbb87a8cbb2b00d305e1e73657a953d75ac1d5d6831e9e4556201b2a88c21dad8a0ae4b8c9edf83bb01acbb1b26ab5e33dedb6c97ea12434
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD502e4d47cbb9cf2affe1a6d96af753a42
SHA1fe76259bc3376a8aa287867933c6bfd7fdae1944
SHA2568079d35a07b892f00cdffeed754377382353a6e5870c06c02dc8dbaf809d291a
SHA512cc47f23bb8b014458285ee912566350c0d09c49d9e40666790694b4d4d7961abbf7adcf9d54e78571a3b97d27a05c58f3db3fdaaa3f4221130a248ed780a1746