f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Size 425KB
Sample240612-3sayrazamn
SHA256 f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8
MD5 e004c02974f89ba8aacb0635e8f14bf7
SHA1 9bc279a4fe20ff644d3d26f9f91833250adfa02e
SHA512 35e25afdc37b46460b6ad4eb36c0bebe7d47d83d0350cf21e5866814fd65206f2f42d3272f9e2c2738b041ca7bb4a3e150d1be15b2faa23b37cb1566771fb9da
SSDEEP 6144:YuJqVxato4Sm5y2A+RltSNiAxTRO+OfJnopE9u8S9XxKvLGIJAvsQf:EVxato4SOA+RltSNi7+YJopEw8SNYvo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4224	Logo1_.exe
4220	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\FileAssociation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\ModifiableWindowsApps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\jsaddins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\ = "ELF Document"	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F3E2E9~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.*\ = "Inspect.Document"	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\DefaultIcon	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F3E2E9~1.EXE,1"	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\print\command	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\printto\command	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F3E2E9~1.EXE \"%1\""	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F3E2E9~1.EXE /p \"%1\""	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\printto	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.*\ShellNew	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.*\ShellNew\NullFile	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\open\command	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\open	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inspect.Document\shell\print	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.*	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe
4224	Logo1_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4220	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
4220	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1116	2216	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe	82
PID 2216 wrote to memory of 1116	2216	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe	82
PID 2216 wrote to memory of 1116	2216	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe	82
PID 2216 wrote to memory of 4224	2216	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe	83
PID 2216 wrote to memory of 4224	2216	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe	83
PID 2216 wrote to memory of 4224	2216	f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe	83
PID 4224 wrote to memory of 4324	4224	Logo1_.exe	85
PID 4224 wrote to memory of 4324	4224	Logo1_.exe	85
PID 4224 wrote to memory of 4324	4224	Logo1_.exe	85
PID 4324 wrote to memory of 4984	4324	net.exe	87
PID 4324 wrote to memory of 4984	4324	net.exe	87
PID 4324 wrote to memory of 4984	4324	net.exe	87
PID 1116 wrote to memory of 4220	1116	cmd.exe	88
PID 1116 wrote to memory of 4220	1116	cmd.exe	88
PID 1116 wrote to memory of 4220	1116	cmd.exe	88
PID 4224 wrote to memory of 3388	4224	Logo1_.exe	56
PID 4224 wrote to memory of 3388	4224	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
  "C:\Users\Admin\AppData\Local\Temp\f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44BA.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe
      "C:\Users\Admin\AppData\Local\Temp\f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:4220
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 254KB
SHA256 fbc2cf414606174f3555d76fe647557b72ac47e6bda0864fd8c5dad738df1733
MD5 48b536408ac1a66263ed8da4ec21add8
SHA1 62d20d73d6035d5ce1e1bf1068ff3bf52d609c3b
SHA512 44f09df70cb4cafa63f88899b0b0fa07bf8fcd5d0106a9a945453de7570c37985039c4a7267708815b6c707539e9a4472d329f010f6a692c5c1fcaab6c41f1c0
SSDEEP 6144:GuJQgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:3itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnlockSuspend.exe

Path C:\Program Files\UnlockSuspend.exe
Size 295KB
SHA256 4bbe258f46928cbc4a72f41f36eadddde75b9f3b240b0e96017399a0fc21757b
MD5 22ce877492da13981254d2ae1dc738b0
SHA1 b5b77abf02d3816873de45e0dae2abc8a37e3f63
SHA512 7349f919d086802df2a6b993ea63cb901db1b8eed5d45522c067b25b159149c0ca27559ebe407c8008732065e0afd67b49ff68c6407ab4121c799530e68f9b5d
SSDEEP 6144:YuJ3pYGHTvQuoQckLcDVZK4IY3IPdO6GOR9qcR3aI:/YGHbQudQZK4IrM28I
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 639KB
SHA256 c013780783b3c6105da7ffd4b46452fadec0336c22a310fc20a3b67778855105
MD5 f1a31b2ce27caa12b0c83698d2266dbe
SHA1 41d0f0731185588db910853ce965e677bd2e53e5
SHA512 a12d12be843f39c38bc6e596c08760744bf07f4a06636a592a883989ec4467b76b9ca6b859bfd997a9d6cb85e3abbac82729e71ea989df9d3ba065e740e12206
SSDEEP 12288:w85mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:v5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a44BA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a44BA.bat
Size 722B
SHA256 b5b471047b8b4e6f191e12ed4a5555fc7186fc2b3e5634844f496bc358886e69
MD5 a01e3040f3e82f5032e482abaa67d77f
SHA1 378fc7201a568e845394c4ecdf4ecb55e27d5901
SHA512 876f733228a7196f834db9f5f3c416c91ab1ce9058a134e17442677b3e8651b7e77a16b1b106af6debfdfcb4c1338d6386bacfc8012a48c34001f69d66698bd0
MD5 SHA1 SHA512

Submit Download

f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\f3e2e96aa6be0286629fd00c0002888c55ce46e1ebb666b37a6be0367097d6c8.exe.exe
Size 396KB
SHA256 7bacbf5c4895050cd1c07e28514ae291094a126258c1af0d959235cc1d052a63
MD5 4312bf80680b69fc0f8b6d68cd8e6839
SHA1 77532c32359bf052f583248b5884e374ceb5ad8a
SHA512 145c5017b9953062585c3c4a4d2747b116c631a3709669681e517eb4b036b35d193b3734c766017087c1e560dccfb0971f776a4a25d8e9a9cff48e1019b1e8ba
SSDEEP 6144:9Vxato4Sm5y2A+RltSNiAxTRO+OfJnopE9u8S9XxKvLGIJAvsQf:9Vxato4SOA+RltSNi7+YJopEw8SNYvo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a
MD5 9fcfb6b631b5a62c2af6f852de61dc71
SHA1 02149b5ae9d7c72cc2df500a9cf25ef4234614e1
SHA512 69076244e4c53b09a9d3595e6b53201013ce006da986542f8375223640e5ce66d000c9f02c71d3856ea0f3f788c139fce670ae26c571bd71d801bd67e15cb66a
SSDEEP 384:Nbbthukfv1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:p3Hv16GVRu1yK9fMnJG2V9dHS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\_desktop.ini
Size 9B
SHA256 45129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1
MD5 1f206a052c160fd77308863abd810887
SHA1 3b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1
SHA512 bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5
MD5 SHA1 SHA512

Submit Download

memory/2216-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2216-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-1232-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-4798-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4224-5237-0x0000000000400000-0x0000000000436000-memory.dmp

Download