Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 09:32
Static task
static1
Behavioral task
behavioral1
Sample
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe
Resource
win7-20240220-en
General
-
Target
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe
-
Size
33KB
-
MD5
9331307acc6ea0119adac27759d11956
-
SHA1
10cc3b729963eaf37ece65bfb77e4baf37a47003
-
SHA256
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d
-
SHA512
9da4e4b2a124a3d1f25e22efe0681edb9ca900b03ae907fca9f320ef64ff05cac5cf6598c8c3f3af7bba561d927158de2362d8100e62081482c19af40fa118a8
-
SSDEEP
768:FlSTRgpQFJFKZj1PVs9Ag1vzbExhU1GBRSkji:F4Tncx1aeg1vye1MRS
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exedescription ioc process File opened (read-only) \??\W: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\S: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\O: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\N: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\E: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\V: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\U: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\Q: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\L: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\K: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\Z: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\T: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\R: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\J: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\H: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\G: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\Y: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\X: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\P: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\M: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened (read-only) \??\I: 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exedescription ioc process File created C:\Program Files\Windows Defender\fr-FR\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\fr-FR\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Media Player\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Adobe\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe -
Drops file in Windows directory 2 IoCs
Processes:
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exedescription ioc process File created C:\Windows\rundl132.exe 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe File created C:\Windows\Dll.dll 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exepid process 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exenet.exenet.exedescription pid process target process PID 2924 wrote to memory of 2992 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2924 wrote to memory of 2992 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2924 wrote to memory of 2992 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2924 wrote to memory of 2992 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2992 wrote to memory of 2852 2992 net.exe net1.exe PID 2992 wrote to memory of 2852 2992 net.exe net1.exe PID 2992 wrote to memory of 2852 2992 net.exe net1.exe PID 2992 wrote to memory of 2852 2992 net.exe net1.exe PID 2924 wrote to memory of 2848 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2924 wrote to memory of 2848 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2924 wrote to memory of 2848 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2924 wrote to memory of 2848 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe net.exe PID 2848 wrote to memory of 2844 2848 net.exe net1.exe PID 2848 wrote to memory of 2844 2848 net.exe net1.exe PID 2848 wrote to memory of 2844 2848 net.exe net1.exe PID 2848 wrote to memory of 2844 2848 net.exe net1.exe PID 2924 wrote to memory of 1064 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe Explorer.EXE PID 2924 wrote to memory of 1064 2924 335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe"C:\Users\Admin\AppData\Local\Temp\335e1655106eb4e07013c87fae6ae18f87132e28ab6b78f0a80889684d10316d.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2852
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2844
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5faaa09cb2d9197da4a00a0df01ac2e5c
SHA1ce497e70212da947764b054c161a468be867cf1b
SHA25651d9d9203fddf941f10518b44fa657ea3a68c2156ba573b36cbec3c8959992c6
SHA51298feb4b1927fe22b02fa5169dd77b774b8d467ff71ca6b5d6f5244723e6d4ce118d647821db2e1cbc8441316fdbec463bd1d06ce3a398b3ed43c7834ecbf43c6
-
Filesize
717KB
MD52ed78a6c3ceb05a797136801832362d1
SHA192b80be47703bcc757ebd271989a06746bd3136b
SHA256879d0c9b666fdaa2d6d8c75778ff85c5922942dd99eb21ee1e4cef4ada3f9b5a
SHA512547f99bbabca1991c4623a3593e22491a277f53be488abe737152268f1478a5937d6fa3904e2d3b24d964f8422e18e863e49b6c3b766b9f2db7f99b14662bcdb
-
Filesize
478KB
MD55e54b5419052a6321d15fe6088be5258
SHA1420003c0ad68fa2b977bee9e2ca2d1a53f8f1ec2
SHA256142a70f95c82ea8acba8d3550273a20411a5b82f6d1b1c9657db51c3f83d5d97
SHA5126d2d2025ed17d6f730d3fbb3a5549e60cfe951c7d9e0063f4ecca045ee28a375eac11fb9aa9cc484b181369165a0f7abae967807bad16aac0e4b60b7a8092f71
-
Filesize
8B
MD5a6f28952c332969f9e6d9f7d1a449737
SHA131c0826adb63cc03162fb9e88781f4b50da8f11b
SHA256d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
SHA5128187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac