Analysis
- max time kernel
149s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe
Resource
win7-20240419-en
windows7-x64
11 signatures
150 seconds
General
- Target d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe
- Size 131KB
- Sample240603-w455psfh83
- SHA256 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46
- MD5 9897b33b294bb626443aa2922a60a4e0
- SHA1 9024d6a37cd45b8a732dc241fb9994bd32c0b773
- SHA512 2668e15c74bdc8aa69a103b77ae26414598498e7eb5c2b00c740dda9acd3cb86dfc1385a1f133536ca761d29bbb75caecd86d12073663f7d36a8bf5ff2a1b67f
- SSDEEP 1536:/BqYsrz8VuJlMXaDuiNbR8Bftg+9t/p4QAILJuCOPdvX/ZWOtnGWxlP:/Bql8ulMXaKvvgmJAIlwPxX/ZWOFrb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 868 Logo1_.exe 1752 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Licenses16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe File created C:\Windows\Logo1_.exe d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe 868 Logo1_.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1752 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 1752 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3372 wrote to memory of 1236 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 83 PID 3372 wrote to memory of 1236 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 83 PID 3372 wrote to memory of 1236 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 83 PID 1236 wrote to memory of 3572 1236 net.exe 85 PID 1236 wrote to memory of 3572 1236 net.exe 85 PID 1236 wrote to memory of 3572 1236 net.exe 85 PID 3372 wrote to memory of 548 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 89 PID 3372 wrote to memory of 548 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 89 PID 3372 wrote to memory of 548 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 89 PID 3372 wrote to memory of 868 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 91 PID 3372 wrote to memory of 868 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 91 PID 3372 wrote to memory of 868 3372 d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe 91 PID 868 wrote to memory of 5084 868 Logo1_.exe 92 PID 868 wrote to memory of 5084 868 Logo1_.exe 92 PID 868 wrote to memory of 5084 868 Logo1_.exe 92 PID 5084 wrote to memory of 3464 5084 net.exe 94 PID 5084 wrote to memory of 3464 5084 net.exe 94 PID 5084 wrote to memory of 3464 5084 net.exe 94 PID 548 wrote to memory of 1752 548 cmd.exe 95 PID 548 wrote to memory of 1752 548 cmd.exe 95 PID 548 wrote to memory of 1752 548 cmd.exe 95 PID 868 wrote to memory of 2040 868 Logo1_.exe 96 PID 868 wrote to memory of 2040 868 Logo1_.exe 96 PID 868 wrote to memory of 2040 868 Logo1_.exe 96 PID 2040 wrote to memory of 3612 2040 net.exe 98 PID 2040 wrote to memory of 3612 2040 net.exe 98 PID 2040 wrote to memory of 3612 2040 net.exe 98 PID 868 wrote to memory of 3600 868 Logo1_.exe 56 PID 868 wrote to memory of 3600 868 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe"C:\Users\Admin\AppData\Local\Temp\d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5246.bat3⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe"C:\Users\Admin\AppData\Local\Temp\d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3464
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3612
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 cd9b6b425d624455491f2ecded3dd2eb9ea18a9a01a9e7024a7265b913cfb3f4
- MD5 d27c63e967bc8b5fd47f2ed92a7c31d4
- SHA1 61d4de0e67b9ff62bbb9c1abeffaa013af804f20
- SHA512 d01d9b413904b54fe10ded037c3aa152f2484b375bb2f534e2287b2ba210db9bb138875a0cfcdba45f1e526747c782960d1ab3357eefbc034bec571177fba951
- SSDEEP 6144:JqG5KFgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:JqPSitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 4d5cef8d007e7c92fa50bd8e1d88e35f4f12e1b066de4a94d703d41e093cfc25
- MD5 7c903b590b5471fdb6f912182c55f598
- SHA1 613979c4db3458338017e9eae26d939483579a8f
- SHA512 e46aebace8ec5d17c1e1131e9a24c5b530392188003325e0c8ba5c4e01829680510932f8a0ae0ba85b136a1a4a36830b84aee8145e017ab22505472c20befec1
- SSDEEP 6144:YqG5KQE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQL:YqPr7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 644KB
- SHA256 f168cda7cfa0f4f1d8dc26f615772410afe41b43fbc3da3cfe2c249b1eadca30
- MD5 11e0853d537d2721ecc655c1fc527e91
- SHA1 c8e23d103e93073ba7c93374878ae9a9f926c944
- SHA512 3e5af85789e480d355053e9ded02108ae53136aec795d5d37faf1d5426275f7f3729e5583b0a95b3434d5b4452c7382405c0f8bc94e8a65275335c62268e0ee2
- SSDEEP 12288:gBPh5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:IPh5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a5246.bat
- Size 722B
- SHA256 1cb3656dd004a272d5dcc7e17afc10abd04c38330455df08c312afba2a16bb60
- MD5 09b3d0da011f453df3e10d7ade4d2e18
- SHA1 58478174125c6a53f30993e0ef634695f3e1ccab
- SHA512 f34fb2970d6458ccdb85d4c83e9e418bcc18cce9d55ab7822274c347597630bd72fe921f91d9285b3053e302fa9e5eef32a0d6bdc2573a3271e69180d0c11258
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\d41b2cb14182340c090b395a2eddd4b42133b0df7ebbdc6a77325e66a38a2e46.exe.exe
- Size 97KB
- SHA256 6b42e2e9822b99f5f13a6d1f639fa64cc93001266ceb7a7d342da1bce84d5c08
- MD5 713a30695b671b6e3b19b7d09f9d8409
- SHA1 83916537c86d7dc1043c752f195f04fa42813afe
- SHA512 a450c691e0c8d16519b418b366a260360a57e8511c6975f2e3029c41f30a68d83448126c3d57c9fb36b3a44e839d4bbcaa73e0adfe305a71e04def2fd990cbf7
- SSDEEP 1536:UR8Bftg+9t/p4QAILJuCOPdvX/ZWOtnGWxlP:xvgmJAIlwPxX/ZWOFrb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 4836226708703a884cbf785b4d4f10d3042daac184de30a47263d47c9f31c9b4
- MD5 ef01f71a4c5d601732f01e9b5d6ea283
- SHA1 073fcc96b3f22df37387be1006700d90346fc342
- SHA512 009a4397351e1a406f4531edb1a071f207c9213750018441296dcac28670bc7af57165f67d72631bed1d56eff89148c751cea40aabc608532c60b39791e85a0f
- SSDEEP 768:mYBqih+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/BqYsrz8VuJlMXaDuiN
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512