Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
General
- Target 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe
- Size 93KB
- Sample240603-w45tyafh78
- SHA256 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1
- MD5 e92420acea85493900a572d0202b1e7c
- SHA1 82e07afa913a93ec95a179262475fe0dc42f33de
- SHA512 c0513fdf062a4e378e41fb4e638a2f8e4bac834c09305bd4c5feb8ba56cde2c97271397f8e2d284362187a48591becd9dfee0ef4b2db412c3022736c8eb933b4
- SSDEEP 1536:/BqYsrz8VuJlMXaDuiN4JvJnBpwdaMIOOnToIfiV6pdQ:/Bql8ulMXaK7JvxKaCqTBfioo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 4416 Logo1_.exe 2208 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe 4416 Logo1_.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4696 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 81 PID 3608 wrote to memory of 4696 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 81 PID 3608 wrote to memory of 4696 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 81 PID 4696 wrote to memory of 1168 4696 net.exe 83 PID 4696 wrote to memory of 1168 4696 net.exe 83 PID 4696 wrote to memory of 1168 4696 net.exe 83 PID 3608 wrote to memory of 1720 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 84 PID 3608 wrote to memory of 1720 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 84 PID 3608 wrote to memory of 1720 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 84 PID 3608 wrote to memory of 4416 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 86 PID 3608 wrote to memory of 4416 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 86 PID 3608 wrote to memory of 4416 3608 82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe 86 PID 4416 wrote to memory of 1288 4416 Logo1_.exe 87 PID 4416 wrote to memory of 1288 4416 Logo1_.exe 87 PID 4416 wrote to memory of 1288 4416 Logo1_.exe 87 PID 1288 wrote to memory of 2940 1288 net.exe 89 PID 1288 wrote to memory of 2940 1288 net.exe 89 PID 1288 wrote to memory of 2940 1288 net.exe 89 PID 1720 wrote to memory of 2208 1720 cmd.exe 90 PID 1720 wrote to memory of 2208 1720 cmd.exe 90 PID 1720 wrote to memory of 2208 1720 cmd.exe 90 PID 4416 wrote to memory of 2948 4416 Logo1_.exe 93 PID 4416 wrote to memory of 2948 4416 Logo1_.exe 93 PID 4416 wrote to memory of 2948 4416 Logo1_.exe 93 PID 2948 wrote to memory of 3952 2948 net.exe 95 PID 2948 wrote to memory of 3952 2948 net.exe 95 PID 2948 wrote to memory of 3952 2948 net.exe 95 PID 4416 wrote to memory of 3444 4416 Logo1_.exe 56 PID 4416 wrote to memory of 3444 4416 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe"C:\Users\Admin\AppData\Local\Temp\82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51C9.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe"C:\Users\Admin\AppData\Local\Temp\82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe"4⤵
- Executes dropped EXE
PID:2208
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2940
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3952
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 cd9b6b425d624455491f2ecded3dd2eb9ea18a9a01a9e7024a7265b913cfb3f4
- MD5 d27c63e967bc8b5fd47f2ed92a7c31d4
- SHA1 61d4de0e67b9ff62bbb9c1abeffaa013af804f20
- SHA512 d01d9b413904b54fe10ded037c3aa152f2484b375bb2f534e2287b2ba210db9bb138875a0cfcdba45f1e526747c782960d1ab3357eefbc034bec571177fba951
- SSDEEP 6144:JqG5KFgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:JqPSitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 4d5cef8d007e7c92fa50bd8e1d88e35f4f12e1b066de4a94d703d41e093cfc25
- MD5 7c903b590b5471fdb6f912182c55f598
- SHA1 613979c4db3458338017e9eae26d939483579a8f
- SHA512 e46aebace8ec5d17c1e1131e9a24c5b530392188003325e0c8ba5c4e01829680510932f8a0ae0ba85b136a1a4a36830b84aee8145e017ab22505472c20befec1
- SSDEEP 6144:YqG5KQE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQL:YqPr7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 644KB
- SHA256 f168cda7cfa0f4f1d8dc26f615772410afe41b43fbc3da3cfe2c249b1eadca30
- MD5 11e0853d537d2721ecc655c1fc527e91
- SHA1 c8e23d103e93073ba7c93374878ae9a9f926c944
- SHA512 3e5af85789e480d355053e9ded02108ae53136aec795d5d37faf1d5426275f7f3729e5583b0a95b3434d5b4452c7382405c0f8bc94e8a65275335c62268e0ee2
- SSDEEP 12288:gBPh5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:IPh5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a51C9.bat
- Size 722B
- SHA256 ee259dd1ccfab8c89f6014c65032b9df546995735588398bf9e50314716349ab
- MD5 94ab83fbd776ea9321728e192174e2f4
- SHA1 ff9128547e182cbe4e7f6f02974ab8f3f481e7e9
- SHA512 9a8ef4d3b5e3138a63ea4ebe4a2f8d97123f25190f9aee303fcecce1e19a3d7a647df3c69d13845acd017f4b4a5d1577c6910a06315e976c445ebee0a243e6d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\82f81d3bc83d44d6d4f6b93e1c85a63aa77a3f637de2688624471cf47d58bbb1.exe.exe
- Size 60KB
- SHA256 751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b
- MD5 7b112b1fb864c90ec5b65eab21cb40b8
- SHA1 e7b73361f722fc7cbb93ef98a8d26e34f4d49767
- SHA512 bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5
- SSDEEP 768:9jhTbhp28JnBpoldAlE6AtOqdjIOOnToIf1UThPtA115WudvI1:9JvJnBpwdaMIOOnToIfiV6pdQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 4836226708703a884cbf785b4d4f10d3042daac184de30a47263d47c9f31c9b4
- MD5 ef01f71a4c5d601732f01e9b5d6ea283
- SHA1 073fcc96b3f22df37387be1006700d90346fc342
- SHA512 009a4397351e1a406f4531edb1a071f207c9213750018441296dcac28670bc7af57165f67d72631bed1d56eff89148c751cea40aabc608532c60b39791e85a0f
- SSDEEP 768:mYBqih+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/BqYsrz8VuJlMXaDuiN
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512