151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e

Analysis

max time kernel
149s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
Size 369KB
Sample240609-w8la4aec55
SHA256 151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e
MD5 db240637e83eb33e995f0db208ecf07b
SHA1 7a339c01231e3754244b2402a202342c4b90c16a
SHA512 382d3a4cc2595fa4c5f123093c15f96a434582e9a52d8d436514c9f16007d0423eab6e34fc72bb61779d8341da2966a2e25a7b85ba78b0adab8650f44cb9ece6
SSDEEP 6144:e46tGfC0jKzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:e3WFjyU66b5zhVymA/XSRh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
4048	Logo1_.exe
1108	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
File created	C:\Windows\Logo1_.exe	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2072	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	81
PID 1344 wrote to memory of 2072	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	81
PID 1344 wrote to memory of 2072	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	81
PID 2072 wrote to memory of 2124	2072	net.exe	83
PID 2072 wrote to memory of 2124	2072	net.exe	83
PID 2072 wrote to memory of 2124	2072	net.exe	83
PID 1344 wrote to memory of 2008	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	84
PID 1344 wrote to memory of 2008	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	84
PID 1344 wrote to memory of 2008	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	84
PID 1344 wrote to memory of 4048	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	85
PID 1344 wrote to memory of 4048	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	85
PID 1344 wrote to memory of 4048	1344	151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe	85
PID 4048 wrote to memory of 1152	4048	Logo1_.exe	87
PID 4048 wrote to memory of 1152	4048	Logo1_.exe	87
PID 4048 wrote to memory of 1152	4048	Logo1_.exe	87
PID 1152 wrote to memory of 2196	1152	net.exe	89
PID 1152 wrote to memory of 2196	1152	net.exe	89
PID 1152 wrote to memory of 2196	1152	net.exe	89
PID 2008 wrote to memory of 1108	2008	cmd.exe	90
PID 2008 wrote to memory of 1108	2008	cmd.exe	90
PID 4048 wrote to memory of 3940	4048	Logo1_.exe	93
PID 4048 wrote to memory of 3940	4048	Logo1_.exe	93
PID 4048 wrote to memory of 3940	4048	Logo1_.exe	93
PID 3940 wrote to memory of 2212	3940	net.exe	95
PID 3940 wrote to memory of 2212	3940	net.exe	95
PID 3940 wrote to memory of 2212	3940	net.exe	95
PID 4048 wrote to memory of 3460	4048	Logo1_.exe	56
PID 4048 wrote to memory of 3460	4048	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
  "C:\Users\Admin\AppData\Local\Temp\151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a786C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe
      "C:\Users\Admin\AppData\Local\Temp\151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe"
      4⤵
      Executes dropped EXE
      PID:1108
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2196
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 7fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
MD5 256b0680af798047a835349001fd7c41
SHA1 4e43e0268f7f67c341189b7a1ce6c2baa063cb19
SHA512 9564596dffff045aa64d145c6f06951d55dc95d1efaf64be425b1c94cfdb205c13264cf4f27fb3bae5e3e75c32d5fe591d1f92bd4b0d7f9ea279862b78530957
SSDEEP 6144:o46tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:o3WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
MD5 11ad98d96a68eab26bb4077d6fe66965
SHA1 2c2bb45a1fc2d876092eb437c4b663408a94c3eb
SHA512 f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
SSDEEP 6144:e46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:e3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
MD5 0eec0543603f7a8ce8e8f5fee478e1d2
SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a786C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a786C.bat
Size 722B
SHA256 5a5e917f6da461fdd921df9a8f4f00dc3495fdc78d9132e3fb1e111ed645b4f0
MD5 f2509979070eb0770177b5878d1b88bf
SHA1 113186346d29d822e94ef9cdee375bef2bf47c7f
SHA512 85922a661c005be34f1616289aaba231c618c68cb92a18c50239ad284d650d900cebff33da5562b3802b0afd7ee3fe484b6810ca80b0294a133e0216aaa5761f
MD5 SHA1 SHA512

Submit Download

151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\151f823eca796e6eed8012548aa2341a3b0909eda57ec276e74b00a792c6602e.exe.exe
Size 335KB
SHA256 482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
MD5 40ac62c087648ccc2c58dae066d34c98
SHA1 0e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA512 0c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
SSDEEP 6144:EzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:MU66b5zhVymA/XSRh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 0f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
MD5 0fbf02d223445d573f072dd264ff499c
SHA1 a7c8f8fbbafa35ae853394f9b0e6436661b7b1cb
SHA512 4708c6abc6b615c0537f6f67d7c73a35f9e013220f8798c24cfc2007a51ab7443e143a942ecf6fee90705043e58ab97c1df800a5ddec2da9a10ce8e9d5248fb4
SSDEEP 768:J2MUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JUaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\_desktop.ini
Size 8B
SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
SHA1 25918532222a7063195beeb76980b6ec9e59e19a
SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
MD5 SHA1 SHA512

Submit Download

memory/1344-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1344-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-5168-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-8631-0x0000000000400000-0x000000000043E000-memory.dmp

Download