Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 08:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
General
-
Target
90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe
-
Size
47KB
-
MD5
e56415910c7e03b222c7846fb3a6e5f4
-
SHA1
eb64cafd437f67df714ebd9156fa7ee382e7f004
-
SHA256
90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88
-
SHA512
3233335136bc6649977b9b7ffc0e441c2ce7c39e45348924b99c6b250c1c4e47506338d4295ca2fd3e9f39e5fc61ed6acba54d3f39d112eff21301cc4a9fb180
-
SSDEEP
768:61m3pQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpaoWQ3655Kv1X/qY1MSd:6Bcx1aeg1v9OQZVUKM6+kKpzHqaNrFd
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1964 Logo1_.exe 4192 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe File created C:\Windows\Logo1_.exe 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe 1964 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 884 wrote to memory of 504 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 81 PID 884 wrote to memory of 504 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 81 PID 884 wrote to memory of 504 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 81 PID 504 wrote to memory of 2820 504 net.exe 83 PID 504 wrote to memory of 2820 504 net.exe 83 PID 504 wrote to memory of 2820 504 net.exe 83 PID 884 wrote to memory of 3948 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 87 PID 884 wrote to memory of 3948 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 87 PID 884 wrote to memory of 3948 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 87 PID 884 wrote to memory of 1964 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 89 PID 884 wrote to memory of 1964 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 89 PID 884 wrote to memory of 1964 884 90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe 89 PID 1964 wrote to memory of 2424 1964 Logo1_.exe 91 PID 1964 wrote to memory of 2424 1964 Logo1_.exe 91 PID 1964 wrote to memory of 2424 1964 Logo1_.exe 91 PID 3948 wrote to memory of 4192 3948 cmd.exe 90 PID 3948 wrote to memory of 4192 3948 cmd.exe 90 PID 3948 wrote to memory of 4192 3948 cmd.exe 90 PID 2424 wrote to memory of 1608 2424 net.exe 93 PID 2424 wrote to memory of 1608 2424 net.exe 93 PID 2424 wrote to memory of 1608 2424 net.exe 93 PID 1964 wrote to memory of 5032 1964 Logo1_.exe 94 PID 1964 wrote to memory of 5032 1964 Logo1_.exe 94 PID 1964 wrote to memory of 5032 1964 Logo1_.exe 94 PID 5032 wrote to memory of 944 5032 net.exe 96 PID 5032 wrote to memory of 944 5032 net.exe 96 PID 5032 wrote to memory of 944 5032 net.exe 96 PID 1964 wrote to memory of 3384 1964 Logo1_.exe 56 PID 1964 wrote to memory of 3384 1964 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe"C:\Users\Admin\AppData\Local\Temp\90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6206.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe"C:\Users\Admin\AppData\Local\Temp\90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe"4⤵
- Executes dropped EXE
PID:4192
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1608
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:944
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD554da8c314043c118875430a03c971b26
SHA1cc1e060ba4f2b3b7727d681468db5a9837a5bc96
SHA2566a7e08989e5160ec705370069e95e5a37075a09d44d39152e1ed9b6358e53619
SHA512e2b1c087410980ef9cecf8f79720139c071921e7e11cdb0816c169ad98d4547a4c7c4fee91fb1556294088e9426b14b98699f3eebefa83d904a72a4bc19665a5
-
Filesize
577KB
MD5a5482316b9aca05e2ff7ddaa5672fa75
SHA152bf361e8ef47273c05736450258a70876dd5d3a
SHA25663bd6f4a635b25e679a8eb6928c126b6665e7eb66cf2ad39d78c67cd251805ea
SHA512988b9ef9325d6df5f2ae5131e48c796f19a047618c5b60c921966fcdf1f9033cc7cd362e4901eb237753d6af182fe26082a4d4077c3bef631c0b20af6f122ada
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD52186e704236b47c2268b5e251f696330
SHA1101fdc37baf83fed8f6f8b55f1594a13e5060c4f
SHA256ece9f7bb3d56dff6b865be7804d66254865ca7211619d517a7cf35cabba05144
SHA512f0b451724fe6aa486002e6c86951e0089f5bc6f7cca6cf3b0c9cc8fb55cec0e5ae428c5ce00774e7d71b6427261f37573ffe385cac023f213e438fc031fda806
-
Filesize
722B
MD5c7b0d6ce909151bd15da0ba5d1c949bb
SHA137ec2ba300779699db0f064923a542ce34a49f7d
SHA2560944758f8dfc97b33cda21d5ed8eb7f23e17c0c5f08c01f9b77adaac853c9ec1
SHA512998246fef1bf24c942fd62041a3cbd22a2626b156a1df85e575f5f07e2ca3ebf0e91ab42972b9757140c181a6634c05de889654ce2326359e5ee17efd762b554
-
C:\Users\Admin\AppData\Local\Temp\90efe5fad6a27843ae80b15ca8061186e5148a451c2baa81d5b8e1e9b3e33e88.exe.exe
Filesize14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
Filesize
33KB
MD5b7b3296dd00061042070807bffd52c4f
SHA14c02815f800a1536a56ab17afcd3c591625aae17
SHA256fe885803ed069efd52098fd0b42aad080a8b2e80db80fb3a16d8602d89f3ad8f
SHA51263f6dcf9867fdc7caa28a83afe112a1870c78a5db8610dfb5fe180ec2ca46385bcb0e3a21d3aa726c2049156bd54452206b8d6ca81ea571d29a0ab66e4c1c27b
-
Filesize
9B
MD51f206a052c160fd77308863abd810887
SHA13b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1
SHA25645129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1
SHA512bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5