9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
Size

29KB
MD5

c3a6498aeafb967730b138db7706cfbd
SHA1

82c69ca3f3eaf8bb5fa8288db2b88bc735f18017
SHA256

9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472
SHA512

0a06043720af675a122478c9c71dbb78730821361f7b88ac44a05471a870bfef32e6a8bbead08a4d35be897a031dca9bd46966ea9f7727ceb88d1fa6e1cb43a2
SSDEEP

384:NbbOo1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:p6o16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\E:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\Y:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\X:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\T:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\S:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\R:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\H:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\P:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\O:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\M:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\L:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\J:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\W:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\U:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\Q:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\I:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\G:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\Z:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\V:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened (read-only)	\??\K:	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en-gb\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 1208	712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe	82
PID 712 wrote to memory of 1208	712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe	82
PID 712 wrote to memory of 1208	712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe	82
PID 1208 wrote to memory of 1760	1208	net.exe	84
PID 1208 wrote to memory of 1760	1208	net.exe	84
PID 1208 wrote to memory of 1760	1208	net.exe	84
PID 712 wrote to memory of 3384	712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe	55
PID 712 wrote to memory of 3384	712	9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe
  "C:\Users\Admin\AppData\Local\Temp\9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
d53dfe8ee60a8ec53507b414770b008c

SHA1
3428891b51a84cc48294c7c504ff73815eb09ae6

SHA256
8b03c2b78678dc4c33f2301edcc9de1128c5cf44a1b532fcb5316c773914007f

SHA512
6a5e60f2952a04b6b209cc75ca997f3655cd8cf2a7aea2bc7799eb59e49e638abd7631a6cf3c1455933e961bb6ec1ff3561c6c14027ff4481054243e09af1ab7

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
173KB

MD5
1303e1baaf03da55aefe44f9d97202dd

SHA1
04eae7d7bb804e2784d7cb3702a10cc028eebad5

SHA256
44bf0f314b56c75cd97f4d4c1796d109416f539d623236b2a041f490154fc317

SHA512
b5b08decf0fb12f9f32cce99085c9c17be958ae3bed491ec700003731d1ec6749147885586b7ed2303fd4a72bd0cb4e9b8942e132f384ca8a0bb1e3da2b78089

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
8e20cd4ac13828acae9e458cea8e8c56

SHA1
794cb8e8b5519214c4d4c89e9d5ff0967e224d72

SHA256
ed2019032918ac1a2a246a501166a13f7f2bda2f2ca354ad2db584c41c774e5c

SHA512
e5e6d2147fb76a7c11e738fbfacbe0b189862cdb35b7de75c82b4ed5784b90953cfda3d1052fceecf3f76a9f873b7ed052c70a4847669b7657bfce522ff907d4

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\_desktop.ini

Filesize
8B

MD5
fa8bf97ffdb152205be1f3a9bd9faec3

SHA1
88a5a98b6074543e357ec7ad221eaee5e30ec82a

SHA256
08a129c008511d5fc4ee1e2ad0fad3d0b033407f74285a18c6fe956d5dc2c9cb

SHA512
ea0a63f52af441964e4a2cddede537d87f1ad78241c883cf40334801056879bb1639ae75b2d9e3cceb90471837263760fc7d6c6708819c7a73fec703ba098443

Download Submit
memory/712-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-1150-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-1217-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-4782-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/712-5221-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download