bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
Size 70KB
Sample240609-v2ts8ach6w
SHA256 bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d
MD5 b2e7fdc06cd07601c5d3b0f50e4c0685
SHA1 620e3f8b0b0348707518dc5b5db8094c8fdb5e8b
SHA512 93bb8726769454b0d1ff650ecf0d6e9c12046c3f3fc87f3a1ba7cc2484c6a549382c1f5eacd88ef3a535d5c804dedddd00617b722162ad0116009976e51fc012
SSDEEP 1536:JFaYzMXqtGN/CstC9qVFMriw+d9bHrkT5gUHz7FxtJ:JFaY46tGNFC0VFMrBkfkT5xHzD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2340	Logo1_.exe
2840	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre8\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
File created	C:\Windows\Logo1_.exe	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1852	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	82
PID 4856 wrote to memory of 1852	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	82
PID 4856 wrote to memory of 1852	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	82
PID 1852 wrote to memory of 2844	1852	net.exe	84
PID 1852 wrote to memory of 2844	1852	net.exe	84
PID 1852 wrote to memory of 2844	1852	net.exe	84
PID 4856 wrote to memory of 940	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	88
PID 4856 wrote to memory of 940	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	88
PID 4856 wrote to memory of 940	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	88
PID 4856 wrote to memory of 2340	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	89
PID 4856 wrote to memory of 2340	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	89
PID 4856 wrote to memory of 2340	4856	bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe	89
PID 2340 wrote to memory of 5084	2340	Logo1_.exe	91
PID 2340 wrote to memory of 5084	2340	Logo1_.exe	91
PID 2340 wrote to memory of 5084	2340	Logo1_.exe	91
PID 940 wrote to memory of 2840	940	cmd.exe	93
PID 940 wrote to memory of 2840	940	cmd.exe	93
PID 5084 wrote to memory of 1756	5084	net.exe	94
PID 5084 wrote to memory of 1756	5084	net.exe	94
PID 5084 wrote to memory of 1756	5084	net.exe	94
PID 2340 wrote to memory of 3100	2340	Logo1_.exe	95
PID 2340 wrote to memory of 3100	2340	Logo1_.exe	95
PID 2340 wrote to memory of 3100	2340	Logo1_.exe	95
PID 3100 wrote to memory of 8	3100	net.exe	97
PID 3100 wrote to memory of 8	3100	net.exe	97
PID 3100 wrote to memory of 8	3100	net.exe	97
PID 2340 wrote to memory of 3420	2340	Logo1_.exe	56
PID 2340 wrote to memory of 3420	2340	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
  "C:\Users\Admin\AppData\Local\Temp\bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B9D.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe
      "C:\Users\Admin\AppData\Local\Temp\bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe"
      4⤵
      Executes dropped EXE
      PID:2840
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1756
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 20b8813493fa940a34f16c61f9d03b8640df98064d3c3d5c4b8096d121a320ba
MD5 117953447e5ae2643f80661c4a3b58dc
SHA1 9b7c7a2b906858319d8e65e1b10d8ecd330cbfce
SHA512 55dabab54387e45ac41328a6b90d505fa66ee0e8f409c3687f81508ccf8897fa01d50b05efa5d588a2a70088da2b505882b44b5450965699c70a10237e4a19d9
SSDEEP 6144:646tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:63WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BlockDeny.exe

Path C:\Program Files\BlockDeny.exe
Size 1.3MB
SHA256 bd20533f5e1730e1f6fcd52040b51ca4958c8c773aeb9509bdfbeef23973db99
MD5 8492136ddb16917a2fd0f06ae94ce22c
SHA1 fc1f3c6c4aa22dd92ba855bb27a79411069370f4
SHA512 71283c22066c31c7c00992c07eb4468ed7a13417d7e22af0420f802512c432e0316b666028a7737410c4eefe73ae60643983234409d6b715c2b38dddd1c73534
SSDEEP 24576:F3MHzLlo8g2RXzp7MZYg/ma5fLKV2TQw9rXZfP1zIG05mmOUcQ1ukz3s4ML:FOzL68g0psf1KyQizeAmOMukzsb
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
MD5 0eec0543603f7a8ce8e8f5fee478e1d2
SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a5B9D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5B9D.bat
Size 722B
SHA256 7fc3ebfc38ba9f185d85507822eaf3bfb02aefe79ecc2354204f531feb290a00
MD5 15e12c9569c6362734a723286fa655c1
SHA1 e78ed6275eaf7894db4cb4bdf1698ea2b45f01eb
SHA512 ba690aaa684c0bc1e62f09009c8bc9e2ed66dfe9cf68b432ffaa0a77d9c6fba085b0115919b5266f1fae2ac2bcbb3fba5511d808cc8d46df9f3b2553571f038b
MD5 SHA1 SHA512

Submit Download

bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\bb62c9d90ad457892206a4c13ca7210b746bbee3e541d259b0881a52c802195d.exe.exe
Size 36KB
SHA256 8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
MD5 9f498971cbe636662f3d210747d619e1
SHA1 44b8e2732fa1e2f204fc70eaa1cb406616250085
SHA512 b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
SSDEEP 768:CNic1iTEpgSG9TJVQBWZrvW5TNDWfKgUkKtzYiguHAMxkEZ2e:mriw+d9bHrkT5gUHz7FxtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 c55667dfc241510c705ae18a591bd521fdb6f4532ff362a49d8f4c17eb1f9975
MD5 71fef4697aa2b93f4407649582c6c8ba
SHA1 42fb512a17b70212bec3096673d983403ec7f8e6
SHA512 efb7d15521b285ba6921a11d3fe830ee457eadff6896f623836b1bf1c7d9f541a2e3b031635034008112f6071fb742cb33cbfc26c7dc43ed347a6d34b16e1c29
SSDEEP 768:JPMUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JFaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini
Size 8B
SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
SHA1 25918532222a7063195beeb76980b6ec9e59e19a
SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
MD5 SHA1 SHA512

Submit Download

memory/2340-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-4829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-8650-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4856-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4856-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download