cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
Size 33KB
Sample240602-2efreaad87
SHA256 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf
MD5 7514021d14a754dd434e4b38cb87ae3d
SHA1 3ea156bdfea7751e851cf281b20783f3f9a4784d
SHA512 78ccfd339f3d905c1e8cb072951164f6b66407b1928fa2879b53c015a89c5027e2e10f81912bf21464b35d650750da811f0975084cf91b710dd6ead8a1d90308
SSDEEP 768:PvGnElOIEvzMXqtwp/lttaL7HP4wIncLRdR5kP78a0RJW/a:PvUaYzMXqtGNttyUn01Q78a4R
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\M:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\K:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\H:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\U:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\T:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\R:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\N:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\L:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\J:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\G:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\Y:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\S:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\E:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\W:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\X:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\V:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\Q:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\P:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\I:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened (read-only)	\??\Z:	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\Microsoft Office\root\loc\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Dll.dll	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
File created	C:\Windows\rundl132.exe	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2372	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	83
PID 3664 wrote to memory of 2372	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	83
PID 3664 wrote to memory of 2372	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	83
PID 2372 wrote to memory of 1972	2372	net.exe	85
PID 2372 wrote to memory of 1972	2372	net.exe	85
PID 2372 wrote to memory of 1972	2372	net.exe	85
PID 3664 wrote to memory of 3708	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	89
PID 3664 wrote to memory of 3708	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	89
PID 3664 wrote to memory of 3708	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	89
PID 3708 wrote to memory of 4232	3708	net.exe	91
PID 3708 wrote to memory of 4232	3708	net.exe	91
PID 3708 wrote to memory of 4232	3708	net.exe	91
PID 3664 wrote to memory of 3448	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	56
PID 3664 wrote to memory of 3448	3664	cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Temp\cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe
  "C:\Users\Admin\AppData\Local\Temp\cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1972
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 f4126de53afbb2a68dead67d01bae1d52b38ae711b06d94629f952099e691d32
MD5 dabffb38234f007c501cf88551471dfe
SHA1 ea9f4c4f46ffd3cb73b767b729c62cfcca6a065c
SHA512 02229668f14c8057849b6e0babac2a5369e904178d8ac2ae5ac5dcff2ea659f4765b1590a4fe482165a4b2de7da43cb80c040befdf0410b3837ef7dfc915b6cf
SSDEEP 6144:x46tGdyTgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:x3N8itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 177KB
SHA256 b5dca266eab324d4f3e9f07a511768335201be7c9ed015f06693e8fe9bd7cfad
MD5 d6d0a61fcca7f899396c7117c8df1731
SHA1 97bb2fe6e910a48a550d8033d39b7f40e03fa00a
SHA512 583b6f995d9912b576ff433b0948f0f24a5793a49ee0e402c28277f17fd830da73dfa3a6b836289b738e4ba2eb6bf99ee402178d517077c9e611fb470408104a
SSDEEP 3072:PvUaY46tGNttyJQ7KRlDfByOpGjAvb3eLG2FmDDSrDVTFooWZet3:k46tGdy/pyOpGcj3UFmDDSrDVTSBQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 643KB
SHA256 8317babad7376315f76f48454d7f4057d60f2a13f0e469a7c877473b220af74f
MD5 c68e034d324260384602839c6e3295de
SHA1 add6ebe18274a2afd7756fcb2b5be590125eff7f
SHA512 7c956a76088bae2a425fc13f8484027ae04bc9995b7ca85a92125801e0676ff660c2a1fcb4640424883455bc10a84d39788032d884e7b64178693b1a2a0885cb
SSDEEP 12288:uF3Nj5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:i3Nj5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini
Size 8B
SHA256 7a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759
MD5 af485d3db9f82d3e5bdc8c6d87fb742e
SHA1 f879c3dbd3d34e9789ff73896508bfbeabbf7468
SHA512 d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360
MD5 SHA1 SHA512

Submit Download

memory/3664-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3664-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3664-4919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3664-8636-0x0000000000400000-0x000000000043E000-memory.dmp

Download