Malware Analysis Report

2025-04-14 04:44

Sample ID 240612-3qwgnswalg
Target 470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a
SHA256 470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a
Tags
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a

Threat Level: Shows suspicious behavior

The file 470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a was found to be: Shows suspicious behavior.

Malicious Activity Summary


Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 23:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 23:43

Reported

2024-06-12 23:46

Platform

win7-20240419-en

Max time kernel

149s

Max time network

123s

Command Line

C:\Windows\Explorer.EXE

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Microsoft Games\Chess\en-US\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\es-ES\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\en-US\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Mail\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\DVD Maker\Shared\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Runs net.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe

"C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

N/A

Files

memory/1148-0-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1208-5-0x0000000002540000-0x0000000002541000-memory.dmp

memory/1148-7-0x0000000000400000-0x0000000000436000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini

MD5 1f206a052c160fd77308863abd810887
SHA1 3b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1
SHA256 45129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1
SHA512 bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5

memory/1148-14-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1148-20-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1148-66-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1148-72-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Program Files\7-Zip\7zFM.exe

MD5 320b5c78b7e64d692ae12690f05de524
SHA1 d1f7c2b3327ed56e5ff05701d3eed1f093ee485b
SHA256 cce15963cc172b1273163ab1b12e15ff4e9da9e2335ff6a7f605850df2fa79cc
SHA512 27f503c2b0cd10f8c28fd6c4d0d089c44c905980a4b37b7b3af2bbcee60a1087bdfd5a20625d650fcfe3b6f8675caf958d7a5718a8ec00864115cd5235e1a525

memory/1148-556-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1148-1849-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1148-2117-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 48b536408ac1a66263ed8da4ec21add8
SHA1 62d20d73d6035d5ce1e1bf1068ff3bf52d609c3b
SHA256 fbc2cf414606174f3555d76fe647557b72ac47e6bda0864fd8c5dad738df1733
SHA512 44f09df70cb4cafa63f88899b0b0fa07bf8fcd5d0106a9a945453de7570c37985039c4a7267708815b6c707539e9a4472d329f010f6a692c5c1fcaab6c41f1c0

memory/1148-3309-0x0000000000400000-0x0000000000436000-memory.dmp

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 de4228cb7a5a7f082477f6a504b822a7
SHA1 dfd84f0b6f4977bfda43b1827aa747a9a5a8a38b
SHA256 8c5089a062734aa1a66e70700d4f33f2f54157c4bb3ed4d6ce1a852de8b6f90b
SHA512 a3b64b10a22dedebfa48e7705e148d50df480fa9bb0669bc06951ab0ff5f97657f72dc8b71db610499ee38ecae9ae494265841a737806bed7c061d0b634913c8

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 23:43

Reported

2024-06-12 23:46

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

57s

Command Line

C:\Windows\Explorer.EXE

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-us\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Windows Defender\it-IT\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-ma\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Google\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\_desktop.ini C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe

"C:\Users\Admin\AppData\Local\Temp\470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/3472-0-0x0000000000400000-0x0000000000436000-memory.dmp

memory/3472-5-0x0000000000400000-0x0000000000436000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-2804150937-2146708401-419095071-1000\_desktop.ini

MD5 1f206a052c160fd77308863abd810887
SHA1 3b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1
SHA256 45129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1
SHA512 bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5

memory/3472-12-0x0000000000400000-0x0000000000436000-memory.dmp

memory/3472-18-0x0000000000400000-0x0000000000436000-memory.dmp

memory/3472-22-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Program Files\dotnet\dotnet.exe

MD5 3663d2163269293cc25be97396086736
SHA1 0ce262073ab6b6e8e5df6ad26aaed4ee7bdc4b95
SHA256 1862fb96abe7cf6ff05b0ce2b9db6b98b9aab219b96f49791438d053adfadeb7
SHA512 a81b044ca46f55ad2045aa6c241b0b42621a7a10e26c0fe4d304f8bee63d9f3285c6fee6e253c0883e337904d0fe4626dd12b6b291b61c35632b69cc4269ae0c

memory/3472-1216-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 48b536408ac1a66263ed8da4ec21add8
SHA1 62d20d73d6035d5ce1e1bf1068ff3bf52d609c3b
SHA256 fbc2cf414606174f3555d76fe647557b72ac47e6bda0864fd8c5dad738df1733
SHA512 44f09df70cb4cafa63f88899b0b0fa07bf8fcd5d0106a9a945453de7570c37985039c4a7267708815b6c707539e9a4472d329f010f6a692c5c1fcaab6c41f1c0

memory/3472-4782-0x0000000000400000-0x0000000000436000-memory.dmp

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

MD5 f1a31b2ce27caa12b0c83698d2266dbe
SHA1 41d0f0731185588db910853ce965e677bd2e53e5
SHA256 c013780783b3c6105da7ffd4b46452fadec0336c22a310fc20a3b67778855105
SHA512 a12d12be843f39c38bc6e596c08760744bf07f4a06636a592a883989ec4467b76b9ca6b859bfd997a9d6cb85e3abbac82729e71ea989df9d3ba065e740e12206

memory/3472-5221-0x0000000000400000-0x0000000000436000-memory.dmp