Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
Resource
win7-20240220-en
General
-
Target
cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
-
Size
33KB
-
MD5
7514021d14a754dd434e4b38cb87ae3d
-
SHA1
3ea156bdfea7751e851cf281b20783f3f9a4784d
-
SHA256
cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf
-
SHA512
78ccfd339f3d905c1e8cb072951164f6b66407b1928fa2879b53c015a89c5027e2e10f81912bf21464b35d650750da811f0975084cf91b710dd6ead8a1d90308
-
SSDEEP
768:PvGnElOIEvzMXqtwp/lttaL7HP4wIncLRdR5kP78a0RJW/a:PvUaYzMXqtGNttyUn01Q78a4R
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\M: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\K: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\H: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\U: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\T: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\R: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\N: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\L: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\J: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\G: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\Y: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\S: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\E: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\W: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\X: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\V: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\Q: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\P: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\I: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened (read-only) \??\Z: cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\Microsoft Office\root\loc\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Dll.dll cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe File created C:\Windows\rundl132.exe cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3664 wrote to memory of 2372 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 83 PID 3664 wrote to memory of 2372 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 83 PID 3664 wrote to memory of 2372 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 83 PID 2372 wrote to memory of 1972 2372 net.exe 85 PID 2372 wrote to memory of 1972 2372 net.exe 85 PID 2372 wrote to memory of 1972 2372 net.exe 85 PID 3664 wrote to memory of 3708 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 89 PID 3664 wrote to memory of 3708 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 89 PID 3664 wrote to memory of 3708 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 89 PID 3708 wrote to memory of 4232 3708 net.exe 91 PID 3708 wrote to memory of 4232 3708 net.exe 91 PID 3708 wrote to memory of 4232 3708 net.exe 91 PID 3664 wrote to memory of 3448 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 56 PID 3664 wrote to memory of 3448 3664 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe"C:\Users\Admin\AppData\Local\Temp\cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe"2⤵
- Drops file in Drivers directory
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1972
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4232
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5dabffb38234f007c501cf88551471dfe
SHA1ea9f4c4f46ffd3cb73b767b729c62cfcca6a065c
SHA256f4126de53afbb2a68dead67d01bae1d52b38ae711b06d94629f952099e691d32
SHA51202229668f14c8057849b6e0babac2a5369e904178d8ac2ae5ac5dcff2ea659f4765b1590a4fe482165a4b2de7da43cb80c040befdf0410b3837ef7dfc915b6cf
-
Filesize
177KB
MD5d6d0a61fcca7f899396c7117c8df1731
SHA197bb2fe6e910a48a550d8033d39b7f40e03fa00a
SHA256b5dca266eab324d4f3e9f07a511768335201be7c9ed015f06693e8fe9bd7cfad
SHA512583b6f995d9912b576ff433b0948f0f24a5793a49ee0e402c28277f17fd830da73dfa3a6b836289b738e4ba2eb6bf99ee402178d517077c9e611fb470408104a
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5c68e034d324260384602839c6e3295de
SHA1add6ebe18274a2afd7756fcb2b5be590125eff7f
SHA2568317babad7376315f76f48454d7f4057d60f2a13f0e469a7c877473b220af74f
SHA5127c956a76088bae2a425fc13f8484027ae04bc9995b7ca85a92125801e0676ff660c2a1fcb4640424883455bc10a84d39788032d884e7b64178693b1a2a0885cb
-
Filesize
8B
MD5af485d3db9f82d3e5bdc8c6d87fb742e
SHA1f879c3dbd3d34e9789ff73896508bfbeabbf7468
SHA2567a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759
SHA512d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360