1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
Size 92KB
Sample240603-s6aj2acd86
SHA256 1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0
MD5 e92964192c0234ea2ae97d0732cbe2ce
SHA1 2153fb1750641bba05c465d70ae4b54d89f0d016
SHA512 b67eeacfd80fb3c46a6c042bb7351adda88b8062e0b12c0dd7b098f93de5edab9116b861982fe1a133c92c345f8e90ad8ef903991fd755d6c2fb450c3b65a3ad
SSDEEP 1536:6g8cx1aeg1v9OQZVUKM6+kKpdyapmebn4ddJZeY86iLflLJYEIs67rxo:6Vf9lOzKM5pMLK4ddJMY86ipmns6S
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
572	Logo1_.exe
4012	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe
572	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3116	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	89
PID 4836 wrote to memory of 3116	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	89
PID 4836 wrote to memory of 3116	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	89
PID 3116 wrote to memory of 2888	3116	net.exe	91
PID 3116 wrote to memory of 2888	3116	net.exe	91
PID 3116 wrote to memory of 2888	3116	net.exe	91
PID 4836 wrote to memory of 2384	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	92
PID 4836 wrote to memory of 2384	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	92
PID 4836 wrote to memory of 2384	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	92
PID 4836 wrote to memory of 572	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	94
PID 4836 wrote to memory of 572	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	94
PID 4836 wrote to memory of 572	4836	1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe	94
PID 572 wrote to memory of 3912	572	Logo1_.exe	95
PID 572 wrote to memory of 3912	572	Logo1_.exe	95
PID 572 wrote to memory of 3912	572	Logo1_.exe	95
PID 3912 wrote to memory of 2860	3912	net.exe	97
PID 3912 wrote to memory of 2860	3912	net.exe	97
PID 3912 wrote to memory of 2860	3912	net.exe	97
PID 2384 wrote to memory of 4012	2384	cmd.exe	98
PID 2384 wrote to memory of 4012	2384	cmd.exe	98
PID 572 wrote to memory of 4568	572	Logo1_.exe	99
PID 572 wrote to memory of 4568	572	Logo1_.exe	99
PID 572 wrote to memory of 4568	572	Logo1_.exe	99
PID 4568 wrote to memory of 4192	4568	net.exe	101
PID 4568 wrote to memory of 4192	4568	net.exe	101
PID 4568 wrote to memory of 4192	4568	net.exe	101
PID 572 wrote to memory of 3384	572	Logo1_.exe	56
PID 572 wrote to memory of 3384	572	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
  "C:\Users\Admin\AppData\Local\Temp\1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1865.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe
      "C:\Users\Admin\AppData\Local\Temp\1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe"
      4⤵
      Executes dropped EXE
      PID:4012
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2860
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 d83106c268ab64ec08d40f302737dfa31f64b8cf001808c9be207a6a51783596
MD5 250d4073d45701926ee7c6df1001936a
SHA1 11e2539dae9a6969b13dde73540e913f7f1bd655
SHA512 95e28f25a08064ec8b19fe215deb095740d1cb37d8c35e58c2ec298617b7abbd28ba46ed19bff6b101ae23dc5230f842fbf4c7523c51e6fc6fc13040bbdc3f6c
SSDEEP 6144:f1NM5pugiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:f1upFitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 f79e6d72c11672df394a2c2f09f0a5e74c842d6e45b00b85d1f34024035a9b04
MD5 93dca6891435ea5d7a316be48765dc25
SHA1 e5edda20d7240ac0b6297b7314f5f8526caa1a9a
SHA512 8c8102bb791384a7cb1247c373afe33f5cabd1ee8e79661ab518c2bc0c5bd6ea331049ed8c83e0435f6b6dc5be7f8e3b16daf7bfa5fb7bceacbf7f0c7317edcb
SSDEEP 6144:q1NM5pHE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:q1upk7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 488KB
SHA256 1b4d273efbdbb6a7d03027e2b308d1c520fc23378667c1d938c51c6dfd416944
MD5 964c45500f6fef6457766729643729f0
SHA1 dee95a0dff13be023265725d4f9da2a861313d51
SHA512 11dfaf885a77a60837d5400cf2cb6cb314205484075c02f683c8bcaed748619b02a5b701a7c19738f58036b7c3d1e73b92799a9aa0e6f5d7a6a890b35fc323aa
SSDEEP 12288:D51upqqIOkU8AMXE9B7PElZlP41N+4PUWfo:N1AqBOkUhMXcBwc04nA
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a1865.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1865.bat
Size 722B
SHA256 6921149e192ce2a3dab5f6693841bc5dc36f33bc02eead659debeb23bc921920
MD5 df95a3d638b3533d98bd94849f882cc4
SHA1 fb41d85fd30415f35644c40182ce21916c0838b8
SHA512 55baa0b40bea02ee0a9e6f8de5a2b6f21d9b66c2f15b7a29fbd6e554ad50ccccadac007015b2fc79853097eb6386f78f3b7f9925d88a853c222acf674db0578e
MD5 SHA1 SHA512

Submit Download

1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\1e67dd804b8304814df2b49185991a0b4b33269aa14221d591d7b2e393205ee0.exe.exe
Size 59KB
SHA256 ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf
MD5 dfc18f7068913dde25742b856788d7ca
SHA1 cbaa23f782c2ddcd7c9ff024fd0b096952a2b387
SHA512 d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945
SSDEEP 768:43CapmeTX3SU4jJvugjHEeJoAAsAug2eXVO86iLflLk+xKEIs6Yig10AMxkEE:4yapmebn4ddJZeY86iLflLJYEIs67rxo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 270c0ba07fbc7ae9462afa9525d71ee9af3d48c76fa7f35513197ed9ddfd5d63
MD5 50e3ab066c2fc9eeebe35389a85b8e1d
SHA1 160e0c746a48ba1cbf0ee5f91891412d975a7b5f
SHA512 b6bae98d2259210e3a0ad7b39d083f38dd5aed04e04ad15d4acc74947d8a577053d6d823d2d67575955e910004da2d240872878618642b6308203a45c8540b3c
SSDEEP 768:6gQmrpQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpa:6g8cx1aeg1v9OQZVUKM6+kKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini
Size 8B
SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
MD5 a6f28952c332969f9e6d9f7d1a449737
SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
MD5 SHA1 SHA512

Submit Download

memory/572-68-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-4187-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-8769-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-247-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-820-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-1575-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-2436-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-8156-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-9-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-5293-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-18-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/572-5730-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4836-12-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4836-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download