Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe
- Size 225KB
- Sample240603-r8a3xabc69
- SHA256 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1
- MD5 94eb81d63281678c2c6115a060e8b40f
- SHA1 2d174b681eb4189eb221a228f94ba73161037692
- SHA512 6da590a28390119f03ce7707af9da862b50474666233fb26598179c84bbbcb0479a7324f847a7696c73afbf2a5ce3e40d51972e264e8a479dc69ea4e19a1a4cb
- SSDEEP 3072:/Bql8ulMXaKqJw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwT:YqG5Kq035iMhL/vGsbTBl2wOsT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 3860 Logo1_.exe 4940 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe File created C:\Windows\Logo1_.exe 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe 3860 Logo1_.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1248 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 91 PID 1476 wrote to memory of 1248 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 91 PID 1476 wrote to memory of 1248 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 91 PID 1248 wrote to memory of 1656 1248 net.exe 93 PID 1248 wrote to memory of 1656 1248 net.exe 93 PID 1248 wrote to memory of 1656 1248 net.exe 93 PID 1476 wrote to memory of 3932 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 94 PID 1476 wrote to memory of 3932 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 94 PID 1476 wrote to memory of 3932 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 94 PID 1476 wrote to memory of 3860 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 96 PID 1476 wrote to memory of 3860 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 96 PID 1476 wrote to memory of 3860 1476 79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe 96 PID 3860 wrote to memory of 3600 3860 Logo1_.exe 97 PID 3860 wrote to memory of 3600 3860 Logo1_.exe 97 PID 3860 wrote to memory of 3600 3860 Logo1_.exe 97 PID 3932 wrote to memory of 4940 3932 cmd.exe 99 PID 3932 wrote to memory of 4940 3932 cmd.exe 99 PID 3932 wrote to memory of 4940 3932 cmd.exe 99 PID 3600 wrote to memory of 4876 3600 net.exe 100 PID 3600 wrote to memory of 4876 3600 net.exe 100 PID 3600 wrote to memory of 4876 3600 net.exe 100 PID 3860 wrote to memory of 1352 3860 Logo1_.exe 101 PID 3860 wrote to memory of 1352 3860 Logo1_.exe 101 PID 3860 wrote to memory of 1352 3860 Logo1_.exe 101 PID 1352 wrote to memory of 2856 1352 net.exe 103 PID 1352 wrote to memory of 2856 1352 net.exe 103 PID 1352 wrote to memory of 2856 1352 net.exe 103 PID 3860 wrote to memory of 3356 3860 Logo1_.exe 57 PID 3860 wrote to memory of 3356 3860 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe"C:\Users\Admin\AppData\Local\Temp\79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3DF.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe"C:\Users\Admin\AppData\Local\Temp\79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe"4⤵
- Executes dropped EXE
PID:4940
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4876
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2856
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:3320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 cd9b6b425d624455491f2ecded3dd2eb9ea18a9a01a9e7024a7265b913cfb3f4
- MD5 d27c63e967bc8b5fd47f2ed92a7c31d4
- SHA1 61d4de0e67b9ff62bbb9c1abeffaa013af804f20
- SHA512 d01d9b413904b54fe10ded037c3aa152f2484b375bb2f534e2287b2ba210db9bb138875a0cfcdba45f1e526747c782960d1ab3357eefbc034bec571177fba951
- SSDEEP 6144:JqG5KFgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:JqPSitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\StartPing.exe
- Size 324KB
- SHA256 6ef85658a6ef33353dce0f3761340b0d94c6aae8ebfa8e0615fb7843ad97be4d
- MD5 7ea2d4a318cc04972922df8085f25ef5
- SHA1 d1c9dd926d3a77f9054b001d26f0777759351146
- SHA512 4c04186dc1980a3331fbae3f6fea56395da1f07a35980aaf9fddafe0ab8c31f8acc05db3554f35aed173888abb5a9e7265c74598de788b20f8eb54daeae0362d
- SSDEEP 6144:YqG5KjmGBUVa0BIvwog0Z4GOzZq8b9LQkL9EASt4pe2EiNV0:YqPKGSR2w2dOthbt/LaASt4HA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 488KB
- SHA256 d51354447034e0374f2596da08118c1ffc638945cca8bbf623f8a9ef1fbd3440
- MD5 97c225a6076098457011512e3a98608e
- SHA1 7acea60aaf36af0706e86969c48cab55873e0f87
- SHA512 37b7e78ad8bfa72ed9eb380f8776007e525fabb44f07636993c30814a9076de673563437d942d4e31eaff9bf1092190343c0d8ff112ad630b3e3727f8a0ed90f
- SSDEEP 12288:gBPfqIOkU8AMXE9B7PElZlP41N+4PUWfo:IPfBOkUhMXcBwc04nA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$aB3DF.bat
- Size 722B
- SHA256 24ed3ab42c84a17894c32ee908df840f38ecbfcb9bc157bfbc0ccd38d8b3fb7a
- MD5 c0f5fbcee70d89bbb4e434cbe89434c0
- SHA1 fa45eed119f55d60600e2793d6559c8e15a2e54c
- SHA512 0dc4d9517a8bcc8ab54b5df79d5f92ec1e845a245507aa06de6a4f3a5af78f0ad6af19e5f6a073165f2980e6f856bc89cf4eb041d2c84584e0485193c64c21dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\79b4349dc1e4ecfe5a29eccd2e4ce891e4af5c743ad063b88eaeb492716d1aa1.exe.exe
- Size 191KB
- SHA256 52def964142be6891054d2f95256a3b05d66887964fcd66b34abfe32477e8965
- MD5 8aa98031128ef0c81d34207e3c60d003
- SHA1 182164292e382455f00349625dd5fd1e41dcc0c8
- SHA512 8ba615af6d4cad84c57c20e318d6277e4bc114c07c14b72088c526a01d414fe719a43551582ecbc38bd352979720d182efc1f639c2c3e91c78b180449bcf2c12
- SSDEEP 3072:4Jw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwT:4035iMhL/vGsbTBl2wOsT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 4836226708703a884cbf785b4d4f10d3042daac184de30a47263d47c9f31c9b4
- MD5 ef01f71a4c5d601732f01e9b5d6ea283
- SHA1 073fcc96b3f22df37387be1006700d90346fc342
- SHA512 009a4397351e1a406f4531edb1a071f207c9213750018441296dcac28670bc7af57165f67d72631bed1d56eff89148c751cea40aabc608532c60b39791e85a0f
- SSDEEP 768:mYBqih+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/BqYsrz8VuJlMXaDuiN
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512