4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
Size

33KB
MD5

3905de443e3362c9a3cf7a99ec967853
SHA1

fad6b90d31da3df8c885fac5d78de93bec539fec
SHA256

4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c
SHA512

151968a824d131913cec483882b9a636aaa1202647f703b376b495e09f3ac1377aed756e85a449613a9cea4487cf9522ec2951e00ecb095e709eb55d21fe4183
SSDEEP

768:mYBuC+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/BVsrz8VuJlMXaDuiN

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\W:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\S:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\R:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\P:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\H:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\G:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\Q:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\O:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\M:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\K:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\I:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\E:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\X:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\V:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\U:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\L:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\Z:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\Y:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\T:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened (read-only)	\??\J:	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Internet Explorer\de-DE\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\DVD Maker\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\_desktop.ini	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
File created	C:\Windows\Dll.dll	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2352	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	28
PID 2004 wrote to memory of 2352	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	28
PID 2004 wrote to memory of 2352	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	28
PID 2004 wrote to memory of 2352	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	28
PID 2352 wrote to memory of 2144	2352	net.exe	30
PID 2352 wrote to memory of 2144	2352	net.exe	30
PID 2352 wrote to memory of 2144	2352	net.exe	30
PID 2352 wrote to memory of 2144	2352	net.exe	30
PID 2004 wrote to memory of 2960	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	31
PID 2004 wrote to memory of 2960	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	31
PID 2004 wrote to memory of 2960	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	31
PID 2004 wrote to memory of 2960	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	31
PID 2960 wrote to memory of 2988	2960	net.exe	33
PID 2960 wrote to memory of 2988	2960	net.exe	33
PID 2960 wrote to memory of 2988	2960	net.exe	33
PID 2960 wrote to memory of 2988	2960	net.exe	33
PID 2004 wrote to memory of 1084	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	18
PID 2004 wrote to memory of 1084	2004	4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1084
- C:\Users\Admin\AppData\Local\Temp\4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe
  "C:\Users\Admin\AppData\Local\Temp\4cfb758bc8d779a7e4f3f549286ac83c8b98d5104f3efa056d8729462bf1645c.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2144
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
8a216d268fb4892b3af2e79a279a2a23

SHA1
51916b0eeb6d61280fac7de0363254427f245762

SHA256
c7a2a1b862ba9fdf706edd930c09dd07af8fb44f3edcfe0a22b41899eebae31d

SHA512
30adf4d918017584c668d9bacf0f6263a9f47087303aaa46ca6a0c9a1e96644fb54b7110ede95819e5782ca189909ce84af8bc80c2a5c1ac21cb62f33f729e93

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
717KB

MD5
87e2e2dfbfec95ff04162e57a04bee58

SHA1
3d527d7351949cfc1081d13093bed1f502a539f1

SHA256
e3baff1970566e3f7557745866bd9d502a543c88ea970b12f52aa7204e80f090

SHA512
89ce52108755d1588c72ece7dabf7f2ebfbd4eddbb8b5439ba6ba85c84e5587aa3a4450b9360a038a001ca59d5a68b563b0170a422acc0e48691c02ebf203732

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
50cb47f0239e9a2044dfa0b0e6d92c14

SHA1
2b20d81a810449f5b994c3d785b6a8f7700a023f

SHA256
fa436f5c793efd8b5908c7bb003a95e126a350f3c5e51edd18ccdaf28aaba7e3

SHA512
27cdb9f9248870b1595fa8ff7f975fe225e80f43f47a6aac2867eadbad0dfea347c4ffa3bd6d52ba95d72d81cc12314b9ab9833d118b7a7bb0be707479371049

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\_desktop.ini

Filesize
8B

MD5
378d822ce12583d0d584184af22d1d77

SHA1
c062ac770b028df6db676099e02f09fc2f77b171

SHA256
1ad01f8e46c86dfa34468e306eabe54b58d56134130b53ea7677961e3baaf6c7

SHA512
23cf7b916de734c6bb6fd3b2beee21f3e82bc95e93d8662dca818d7cf13602706f22671dce61388b2a7e0b613c07c70512331c4132759b16cf438cb1750bc397

Download Submit
memory/1084-3-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/2004-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2004-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2004-3294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2004-4108-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download