Analysis
-
max time kernel
41s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe
-
Size
236KB
-
MD5
56999d5ccc4d91a7c98d90b49bed2807
-
SHA1
022f9537f5b113f9255de6d40fc614a56ef27cf1
-
SHA256
da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c
-
SHA512
2fb0bd2a7088dd991921bb2d0115374b7a11e43106da24fe1ca52f10d76bcf1854dcfeb442c2716458f66a967580c650977b2c50957904cf8640881e1d35e44a
-
SSDEEP
3072:JUaY46tGNFC0VFnpVOqhtWAGYWOvTE4BwSfGuLG8NoqJEPyXK/aWbJSP5xV0BUj:e46tGfC0jnz4KUuS8oqJIgKGe
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1060 Logo1_.exe 2592 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe 1060 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1400 wrote to memory of 3492 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 81 PID 1400 wrote to memory of 3492 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 81 PID 1400 wrote to memory of 3492 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 81 PID 3492 wrote to memory of 1644 3492 net.exe 83 PID 3492 wrote to memory of 1644 3492 net.exe 83 PID 3492 wrote to memory of 1644 3492 net.exe 83 PID 1400 wrote to memory of 3200 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 84 PID 1400 wrote to memory of 3200 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 84 PID 1400 wrote to memory of 3200 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 84 PID 1400 wrote to memory of 1060 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 86 PID 1400 wrote to memory of 1060 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 86 PID 1400 wrote to memory of 1060 1400 da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe 86 PID 1060 wrote to memory of 3692 1060 Logo1_.exe 87 PID 1060 wrote to memory of 3692 1060 Logo1_.exe 87 PID 1060 wrote to memory of 3692 1060 Logo1_.exe 87 PID 3692 wrote to memory of 3100 3692 net.exe 89 PID 3692 wrote to memory of 3100 3692 net.exe 89 PID 3692 wrote to memory of 3100 3692 net.exe 89 PID 3200 wrote to memory of 2592 3200 cmd.exe 90 PID 3200 wrote to memory of 2592 3200 cmd.exe 90 PID 3200 wrote to memory of 2592 3200 cmd.exe 90 PID 1060 wrote to memory of 1360 1060 Logo1_.exe 91 PID 1060 wrote to memory of 1360 1060 Logo1_.exe 91 PID 1060 wrote to memory of 1360 1060 Logo1_.exe 91 PID 1360 wrote to memory of 436 1360 net.exe 93 PID 1360 wrote to memory of 436 1360 net.exe 93 PID 1360 wrote to memory of 436 1360 net.exe 93 PID 1060 wrote to memory of 3344 1060 Logo1_.exe 55 PID 1060 wrote to memory of 3344 1060 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe"C:\Users\Admin\AppData\Local\Temp\da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4759.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe"C:\Users\Admin\AppData\Local\Temp\da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe"4⤵
- Executes dropped EXE
PID:2592
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3100
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:436
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5256b0680af798047a835349001fd7c41
SHA14e43e0268f7f67c341189b7a1ce6c2baa063cb19
SHA2567fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
SHA5129564596dffff045aa64d145c6f06951d55dc95d1efaf64be425b1c94cfdb205c13264cf4f27fb3bae5e3e75c32d5fe591d1f92bd4b0d7f9ea279862b78530957
-
Filesize
577KB
MD511ad98d96a68eab26bb4077d6fe66965
SHA12c2bb45a1fc2d876092eb437c4b663408a94c3eb
SHA2564b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
SHA512f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD50eec0543603f7a8ce8e8f5fee478e1d2
SHA1f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA256636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
SHA512cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
-
Filesize
722B
MD5c27a780d43354d81207e5f67d36047f8
SHA151691d2d5c5ddd5dfeb4da07dcbffd75b42fab31
SHA256547f1820e54391297c785e46166391b9dbe73bcfb8b863a832de512a04ded104
SHA5126eb27d3309647eaae7cfe823dced5fdee7a4fd328f5b0c7ebd5ae2aeb9cbe70ba9e78b0e571f8d55d8b5389464544f39d6af91e81133a80c02c445a9c866dc72
-
C:\Users\Admin\AppData\Local\Temp\da17ba599d0f91d9f17fd55c8ac4a69191cfcb110c0d3c657c8aa70029dbd36c.exe.exe
Filesize203KB
MD55f1ba3be7e873d24ef709bbca0d07f88
SHA17ea62d7d32a18b6904b36501fb4cad573c99ed36
SHA2569d4ebad94997f790d19e8d998c4ee749aa6f73e30fd5512a48a839cb28c75470
SHA51228f6b537ecfffa21041cc317437db1f3970484ebd45b335bd12f3f3f81c58926b4fb9ddcf5e210180cf57106722c21257ff4e95b23434ff5b685882661b6af4d
-
Filesize
33KB
MD50fbf02d223445d573f072dd264ff499c
SHA1a7c8f8fbbafa35ae853394f9b0e6436661b7b1cb
SHA2560f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
SHA5124708c6abc6b615c0537f6f67d7c73a35f9e013220f8798c24cfc2007a51ab7443e143a942ecf6fee90705043e58ab97c1df800a5ddec2da9a10ce8e9d5248fb4
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD59bf5ad0e8bbf0ba1630c244358e5c6dd
SHA125918532222a7063195beeb76980b6ec9e59e19a
SHA256551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
SHA5127fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3