Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe
- Size 258KB
- Sample240603-nlt1qaeb55
- SHA256 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6
- MD5 0643e94b826497671eed2547a1f14457
- SHA1 fd5aa97414170b2be1b2047622bfa87f7dd46abf
- SHA512 ff1ed3439cd62b129699a8a508c666c369f2d12cf8c8931f769e0cda3fba5384cbbd1cd463b2d019188dfce78d6382d4319df80039782bd4b4cd7adf4abe1457
- SSDEEP 6144:L1NM5pugiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:L1upFitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 1120 Logo1_.exe 3468 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe File created C:\Windows\Logo1_.exe 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 332 wrote to memory of 4664 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 92 PID 332 wrote to memory of 4664 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 92 PID 332 wrote to memory of 4664 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 92 PID 4664 wrote to memory of 696 4664 net.exe 94 PID 4664 wrote to memory of 696 4664 net.exe 94 PID 4664 wrote to memory of 696 4664 net.exe 94 PID 332 wrote to memory of 4308 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 95 PID 332 wrote to memory of 4308 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 95 PID 332 wrote to memory of 4308 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 95 PID 332 wrote to memory of 1120 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 97 PID 332 wrote to memory of 1120 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 97 PID 332 wrote to memory of 1120 332 859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe 97 PID 1120 wrote to memory of 4060 1120 Logo1_.exe 98 PID 1120 wrote to memory of 4060 1120 Logo1_.exe 98 PID 1120 wrote to memory of 4060 1120 Logo1_.exe 98 PID 4060 wrote to memory of 2348 4060 net.exe 100 PID 4060 wrote to memory of 2348 4060 net.exe 100 PID 4060 wrote to memory of 2348 4060 net.exe 100 PID 4308 wrote to memory of 3468 4308 cmd.exe 101 PID 4308 wrote to memory of 3468 4308 cmd.exe 101 PID 4308 wrote to memory of 3468 4308 cmd.exe 101 PID 1120 wrote to memory of 4804 1120 Logo1_.exe 102 PID 1120 wrote to memory of 4804 1120 Logo1_.exe 102 PID 1120 wrote to memory of 4804 1120 Logo1_.exe 102 PID 4804 wrote to memory of 3964 4804 net.exe 104 PID 4804 wrote to memory of 3964 4804 net.exe 104 PID 4804 wrote to memory of 3964 4804 net.exe 104 PID 1120 wrote to memory of 3300 1120 Logo1_.exe 57 PID 1120 wrote to memory of 3300 1120 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe"C:\Users\Admin\AppData\Local\Temp\859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1519.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe"C:\Users\Admin\AppData\Local\Temp\859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe"4⤵
- Executes dropped EXE
PID:3468
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2348
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3964
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:3696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 b06c87413a21eb0c1bb294b1debfd2c9665fa655ad85320fa4c354b407089bc0
- MD5 67297746b8e390a85af873ae0f20c5b9
- SHA1 fdfbf7b8009300c9dec5e1b7d44e76c884f37836
- SHA512 6c73751e7bbcd0c2f20e9fa084b9334a89b4022f6666b2288000ad8dbb0a4f1369784825baeda2f5ac671104dab508b6276e12b7c2bd60bf1469a20f1b08da86
- SSDEEP 6144:L1NM5pHE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:L1upk7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 488KB
- SHA256 1b4d273efbdbb6a7d03027e2b308d1c520fc23378667c1d938c51c6dfd416944
- MD5 964c45500f6fef6457766729643729f0
- SHA1 dee95a0dff13be023265725d4f9da2a861313d51
- SHA512 11dfaf885a77a60837d5400cf2cb6cb314205484075c02f683c8bcaed748619b02a5b701a7c19738f58036b7c3d1e73b92799a9aa0e6f5d7a6a890b35fc323aa
- SSDEEP 12288:D51upqqIOkU8AMXE9B7PElZlP41N+4PUWfo:N1AqBOkUhMXcBwc04nA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a1519.bat
- Size 722B
- SHA256 8b40e254ae4c8d2bcb3c8796698592deae630e7df370493d77339731dca959b3
- MD5 1eb38fb72e4f506f4d092f80068154ec
- SHA1 bd9f14d7bdff639274956dbe3073d7d1a353b5ec
- SHA512 da1a87f1534ddbc9cf2a7b742aeb46e9eef0bab43fd0f3cf8edf9aa712d0d86b2410e8c2c28482ce25af48c3a084710c15a4b20a62a36395cd70d05e0683c597
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\859c80a4f4f93c7d8d4fac3f9f8988bc588cb5d3cdddc2ca2a40498fcff1c1a6.exe.exe
- Size 224KB
- SHA256 dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546
- MD5 d4b257c01bbaa68d15d8368475a4e227
- SHA1 fafae083a882e163cfa8c77258baaab891c17df2
- SHA512 167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502
- SSDEEP 6144:DgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:MitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f
- MD5 cb155fa097b198d3c8c93dde11a3ff5a
- SHA1 55c2c08424808910e14db9c7d656d78d5751faf3
- SHA512 75c63fe247b8a59611ca1d94c93319d67402abdad1eb47b2ff6d6cf106e4655e9b8b5462029d170abe52b509a461f2119df8f9548a732003192a787d941ada88
- SSDEEP 768:6FpQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpa:6scx1aeg1v9OQZVUKM6+kKp
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512