Analysis
- max time kernel
149s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
General
- Target 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe
- Size 66KB
- Sample240609-xa22maec95
- SHA256 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7
- MD5 b33584ff7f406984bb6e96c08d8630c9
- SHA1 658facc60eba57d065201dd0aca9b3c2d02c66b6
- SHA512 601adca313691f46d9fc04a67759fb2fb051da8d973d12595b1e3aac9a678eb59f12fd9cfd8990026f6e3591487a396fa295277f88c01ebad9a6743876d4b631
- SSDEEP 768:J2MUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZelRC4OMMwP3Sy6EGyI4q:JUaYzMXqtGN/CstC9qVFRC4ayFGyHNXk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 2284 Logo1_.exe 1504 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MsEdgeCrashpad\attachments\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe File created C:\Windows\Logo1_.exe 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe 2284 Logo1_.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4628 wrote to memory of 2028 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 89 PID 4628 wrote to memory of 2028 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 89 PID 4628 wrote to memory of 2028 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 89 PID 2028 wrote to memory of 728 2028 net.exe 91 PID 2028 wrote to memory of 728 2028 net.exe 91 PID 2028 wrote to memory of 728 2028 net.exe 91 PID 4628 wrote to memory of 4288 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 95 PID 4628 wrote to memory of 4288 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 95 PID 4628 wrote to memory of 4288 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 95 PID 4628 wrote to memory of 2284 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 96 PID 4628 wrote to memory of 2284 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 96 PID 4628 wrote to memory of 2284 4628 47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe 96 PID 2284 wrote to memory of 4176 2284 Logo1_.exe 98 PID 2284 wrote to memory of 4176 2284 Logo1_.exe 98 PID 2284 wrote to memory of 4176 2284 Logo1_.exe 98 PID 4176 wrote to memory of 2380 4176 net.exe 100 PID 4176 wrote to memory of 2380 4176 net.exe 100 PID 4176 wrote to memory of 2380 4176 net.exe 100 PID 4288 wrote to memory of 1504 4288 cmd.exe 101 PID 4288 wrote to memory of 1504 4288 cmd.exe 101 PID 4288 wrote to memory of 1504 4288 cmd.exe 101 PID 2284 wrote to memory of 972 2284 Logo1_.exe 102 PID 2284 wrote to memory of 972 2284 Logo1_.exe 102 PID 2284 wrote to memory of 972 2284 Logo1_.exe 102 PID 972 wrote to memory of 1160 972 net.exe 104 PID 972 wrote to memory of 1160 972 net.exe 104 PID 972 wrote to memory of 1160 972 net.exe 104 PID 2284 wrote to memory of 3524 2284 Logo1_.exe 56 PID 2284 wrote to memory of 3524 2284 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe"C:\Users\Admin\AppData\Local\Temp\47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a124.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe"C:\Users\Admin\AppData\Local\Temp\47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe"4⤵
- Executes dropped EXE
PID:1504
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2380
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1160
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4624,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:81⤵PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 7fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
- MD5 256b0680af798047a835349001fd7c41
- SHA1 4e43e0268f7f67c341189b7a1ce6c2baa063cb19
- SHA512 9564596dffff045aa64d145c6f06951d55dc95d1efaf64be425b1c94cfdb205c13264cf4f27fb3bae5e3e75c32d5fe591d1f92bd4b0d7f9ea279862b78530957
- SSDEEP 6144:o46tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:o3WFj2itXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
- MD5 11ad98d96a68eab26bb4077d6fe66965
- SHA1 2c2bb45a1fc2d876092eb437c4b663408a94c3eb
- SHA512 f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
- SSDEEP 6144:e46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:e3WFjn7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 644KB
- SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
- MD5 0eec0543603f7a8ce8e8f5fee478e1d2
- SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
- SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
- SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a124.bat
- Size 721B
- SHA256 20f2dd02c903ab68ae761d0fa7d645041f194dda09d1ee78af7f5d88fa6b4061
- MD5 333578af644b35cf067e11eb235d5e6a
- SHA1 7e88e7205c05f3260cb67be289b4484888d57a40
- SHA512 2c9e9c3ac41a18e25b049c6b1c8e4e9141ee905b5d600a7bbab2df0c65278e677be8702b279468f92f175ec48544930dc8d190261b1a6e13bcb1f16b50c10f71
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\47e8ae9153f1e441735e09664ade29c7fc59094d237c6ea1ad8283b5765303e7.exe.exe
- Size 33KB
- SHA256 f4a3c012f2859ead10af1298d9b20fbd8ca2257f73d530a2b0c25937cb16f6eb
- MD5 bdbce90ce74990df3b2c7c8484dde146
- SHA1 ae6aadaf5467b97779d4c1a81b5cd3dfb9d8ecb4
- SHA512 78e2f31759ce490f38e898ef17a700dd0898cc32b526325e8d7230b4ff119c39124cd2abf30038f70318931cc995abee523b334a29812bf875302dc126c9f958
- SSDEEP 384:i7lcRCzEOMZ5ngvoBt0OshL9aooUe6Et/B+byIklpXptYVZghJjpANmHXdOYJLi9:TC4OMMwP3Sy6EGyI4t6a9AkHNXLrM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 0f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
- MD5 0fbf02d223445d573f072dd264ff499c
- SHA1 a7c8f8fbbafa35ae853394f9b0e6436661b7b1cb
- SHA512 4708c6abc6b615c0537f6f67d7c73a35f9e013220f8798c24cfc2007a51ab7443e143a942ecf6fee90705043e58ab97c1df800a5ddec2da9a10ce8e9d5248fb4
- SSDEEP 768:J2MUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JUaYzMXqtGN/CstC9qVF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\_desktop.ini
- Size 8B
- SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
- MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
- SHA1 25918532222a7063195beeb76980b6ec9e59e19a
- SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
- MD5 SHA1 SHA512