Malware Analysis Report

2024-10-10 12:45

Sample ID 240613-2mvkjatcng
Target 27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc
SHA256 27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc

Threat Level: Shows suspicious behavior

The file 27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Deletes itself

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:42

Reported

2024-06-13 22:45

Platform

win7-20231129-en

Max time kernel

150s

Max time network

125s

Command Line

C:\Windows\Explorer.EXE

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre7\lib\jfr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Defender\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Mozilla Firefox\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{7AE638D3-C69D-42D5-9B63-3C52AA32D796}\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\DVD Maker\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Mail\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Mail\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\vDll.dll C:\Windows\Logo1_.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2656 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 2656 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 2656 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 2656 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 1504 wrote to memory of 2596 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1504 wrote to memory of 2596 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1504 wrote to memory of 2596 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1504 wrote to memory of 2596 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2596 wrote to memory of 3052 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2596 wrote to memory of 3052 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2596 wrote to memory of 3052 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2596 wrote to memory of 3052 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1504 wrote to memory of 1204 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 1504 wrote to memory of 1204 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe

"C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF9A.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe

"C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\xx.bat" "

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents" /f

C:\Windows\SysWOW64\reg.exe

reg restore "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents" xx.hiv

Network

N/A

Files

memory/2656-0-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aF9A.bat

MD5 c02ef0a38774f4fd5f7379851372f268
SHA1 ca6f8c0034ab46983d9b521ccbb3b0cb4d6ac5c1
SHA256 a9091fdcf54c133bf0ef51af047afbca0e03f2e93cb90d2f18f0188a6a675458
SHA512 37947442b0f17ec667443cf04eb477d0bd43ccd80d682b9cca1799f842c5010a42fa42ee78d0ce6af3407e98d704eeb19316543d6f86c1ea28a09907184759aa

memory/2656-16-0x0000000000260000-0x0000000000294000-memory.dmp

C:\Windows\Logo1_.exe

MD5 32f77fdf4b3fc5c15a5f715d944ff394
SHA1 bc1d64e77162b209ed6993ebadfac5cafbd66a8c
SHA256 a383ab4b52d9be1be5bc1247306ec5161b36095640fd9d315842726eee61788c
SHA512 0c10c8a8b9e77abd1763003876667b59dec19362071659053bdf37cf1faa3efcc226bd51ac803e806938271d63193d0db70f818dc5ceddfd1252e0300650a419

memory/1504-20-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2656-18-0x0000000000260000-0x0000000000294000-memory.dmp

memory/2656-17-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe.exe

MD5 f0d267d6025187615d0cd6e254531747
SHA1 8d668f9e872390cae5eb175e8e6058411e433a58
SHA256 a8973dff9599c80d51353bd1fbeb90d4c6778dcf6a50321d6d3a6b35a20b65b8
SHA512 864d8c2ce26774d6788e9302cb9048ba61c85a12cbfe493e495d61b3f1a94be82af1c25561e155e3be36c501fe0f2bde44f499d0c718d05e7fc5bf81eb2f901d

memory/2076-29-0x0000000000410000-0x000000000043C000-memory.dmp

memory/2868-31-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2868-35-0x0000000000240000-0x000000000026C000-memory.dmp

memory/2868-36-0x0000000000240000-0x000000000026C000-memory.dmp

memory/1204-38-0x0000000002D70000-0x0000000002D71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xx.bat

MD5 eb4282dd6f7b3ec214906b1ddc202f8b
SHA1 3742a6d44a04538b4851b69f0a220c607a024c1d
SHA256 ae3da96838527c3113b60944a65289e96911447015f22415f29770934c041270
SHA512 560219077fa09a5a6e9c602f9ac9070fc5afb899d9aebed7ac7e4adfaa64259131bd495c62a952bfe488a99d604992fbf0233783b01f7371d15af0ed18d91c01

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xx.hiv

MD5 84521630b87933732d1ecdbfcf1d0dc2
SHA1 09b455127e9dc913293d020301acd1996bb6081f
SHA256 386407ce1ee90ed9fbe642f44d5521818642b0ff2ecfae913b9f7229fc44e0c4
SHA512 e6b5ef8930cd28d8cf1adeac866ba0a4e37b3e6364377b71fcb394bbc6e3f086436913d175cf517c805705aa2f80607ee21f3a6ab7859376ef26da85e3178d1b

memory/1504-53-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2868-54-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2868-55-0x0000000000400000-0x000000000042C000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

memory/1504-62-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1504-68-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1504-114-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1504-120-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1504-754-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1504-1873-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1504-2094-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 89e2bd6c320fa3ea7a9cb93138db5adc
SHA1 096cc798cdb1f0ac1c04efdc4e80c9e566dac4df
SHA256 7c4df69da64db61128ce40a9fb94f693457b6fc1291425df53a9c87365946ce7
SHA512 0876eed147f4583e97ea49218039e0f5d26846821cffb72006531771fa3e6af0dd3336b99c07460b6986531d1749fc3f9a2e492e0efdadc0d534dbd632fe331e

memory/1504-3333-0x0000000000400000-0x0000000000434000-memory.dmp

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 4cfdb20b04aa239d6f9e83084d5d0a77
SHA1 f22863e04cc1fd4435f785993ede165bd8245ac6
SHA256 30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA512 35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:42

Reported

2024-06-13 22:45

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\win10\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\ResiliencyLinks\Locales\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\vDll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3316 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 3316 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 3316 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\Logo1_.exe
PID 4912 wrote to memory of 4968 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 4912 wrote to memory of 4968 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 4912 wrote to memory of 4968 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 4968 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4968 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4968 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2044 wrote to memory of 2220 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2044 wrote to memory of 2220 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 2044 wrote to memory of 2220 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe
PID 4912 wrote to memory of 3368 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 4912 wrote to memory of 3368 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5012 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5012 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5012 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5012 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5012 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe

"C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE06D.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe

"C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4224,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\xx.bat" "

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents" /f

C:\Windows\SysWOW64\reg.exe

reg restore "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents" xx.hiv

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 31.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp

Files

memory/3316-0-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Windows\Logo1_.exe

MD5 32f77fdf4b3fc5c15a5f715d944ff394
SHA1 bc1d64e77162b209ed6993ebadfac5cafbd66a8c
SHA256 a383ab4b52d9be1be5bc1247306ec5161b36095640fd9d315842726eee61788c
SHA512 0c10c8a8b9e77abd1763003876667b59dec19362071659053bdf37cf1faa3efcc226bd51ac803e806938271d63193d0db70f818dc5ceddfd1252e0300650a419

memory/3316-10-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4912-13-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aE06D.bat

MD5 934a1c8e886c202ca88eee72de3f2ddb
SHA1 4c9064344a7c8dff97dbc7b1c97cfccce6330da3
SHA256 dd672798c7c09ead5232dfe32e119784bad4acc4827a12f1af976833eace8068
SHA512 0cc5c9726a0479c914f3ab79d2c8dd874c0125d06868df31a3ecae10a6a4eecff75d35f2a60b5b8e1bc0ffe4f5acff6a087584c256241493e2c71d178fba45d0

C:\Users\Admin\AppData\Local\Temp\27ba9f5f533535f0db3c4c0e2e9189329324b88ad43f073deaf23df7165246cc.exe.exe

MD5 f0d267d6025187615d0cd6e254531747
SHA1 8d668f9e872390cae5eb175e8e6058411e433a58
SHA256 a8973dff9599c80d51353bd1fbeb90d4c6778dcf6a50321d6d3a6b35a20b65b8
SHA512 864d8c2ce26774d6788e9302cb9048ba61c85a12cbfe493e495d61b3f1a94be82af1c25561e155e3be36c501fe0f2bde44f499d0c718d05e7fc5bf81eb2f901d

memory/2220-19-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xx.bat

MD5 eb4282dd6f7b3ec214906b1ddc202f8b
SHA1 3742a6d44a04538b4851b69f0a220c607a024c1d
SHA256 ae3da96838527c3113b60944a65289e96911447015f22415f29770934c041270
SHA512 560219077fa09a5a6e9c602f9ac9070fc5afb899d9aebed7ac7e4adfaa64259131bd495c62a952bfe488a99d604992fbf0233783b01f7371d15af0ed18d91c01

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xx.hiv

MD5 84521630b87933732d1ecdbfcf1d0dc2
SHA1 09b455127e9dc913293d020301acd1996bb6081f
SHA256 386407ce1ee90ed9fbe642f44d5521818642b0ff2ecfae913b9f7229fc44e0c4
SHA512 e6b5ef8930cd28d8cf1adeac866ba0a4e37b3e6364377b71fcb394bbc6e3f086436913d175cf517c805705aa2f80607ee21f3a6ab7859376ef26da85e3178d1b

memory/4912-29-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2220-30-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2220-31-0x0000000000400000-0x000000000042C000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3665033694-1447845302-680750983-1000\_desktop.ini

MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

memory/4912-38-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4912-44-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4912-48-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 88bba0880cd91c45e3575a0009b314f5
SHA1 571e17a66e1f0e9154c46f5782a7181e7aff0e94
SHA256 9166fc78aed3bfc84624c5560be9155e66015360a91cd247736823584da19e28
SHA512 2836bd3fbcf850023ef192879960f4f5b957da2727c73c925c37c60b89b0ccb5a55309ec4b815d746572964742cf096cf67f449b6d24e5b75b93ce138a8d3a2a

memory/4912-203-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4912-1249-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 89e2bd6c320fa3ea7a9cb93138db5adc
SHA1 096cc798cdb1f0ac1c04efdc4e80c9e566dac4df
SHA256 7c4df69da64db61128ce40a9fb94f693457b6fc1291425df53a9c87365946ce7
SHA512 0876eed147f4583e97ea49218039e0f5d26846821cffb72006531771fa3e6af0dd3336b99c07460b6986531d1749fc3f9a2e492e0efdadc0d534dbd632fe331e

memory/4912-4983-0x0000000000400000-0x0000000000434000-memory.dmp

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

MD5 2500f702e2b9632127c14e4eaae5d424
SHA1 8726fef12958265214eeb58001c995629834b13a
SHA256 82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
SHA512 f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

memory/4912-5428-0x0000000000400000-0x0000000000434000-memory.dmp