Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe
- Size 39KB
- Sample240613-a3afraxeqa
- SHA256 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273
- MD5 9f85e7536d590c9790216db83cd4226e
- SHA1 4ba479e9e327319c546916f382b5dda9b0217973
- SHA512 1ae9fc776270b6d45834dfc7c6648832df68a1016ae4456153e3fb7524cd190431fc2828dc7933ee2ccd9eac7a08c11e7697a3dcbbcde96d76335b1b08f292ea
- SSDEEP 768:HHO5RroZJ76739AzUJQ+OYkLl2b3+DTQb9OGImt0o:HHe+Zk7qzUJBeLkbiT29dX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\U: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\N: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\L: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\Y: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\I: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\J: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\Z: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\W: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\S: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\R: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\P: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\O: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\K: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\E: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\X: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\T: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\Q: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\M: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\H: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened (read-only) \??\G: 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\Windows Mail\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files\Internet Explorer\en-US\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\EBWebView\x86\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files\Windows Media Player\en-US\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe File created C:\Windows\Dll.dll 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3272 wrote to memory of 4608 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 89 PID 3272 wrote to memory of 4608 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 89 PID 3272 wrote to memory of 4608 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 89 PID 4608 wrote to memory of 2956 4608 net.exe 91 PID 4608 wrote to memory of 2956 4608 net.exe 91 PID 4608 wrote to memory of 2956 4608 net.exe 91 PID 3272 wrote to memory of 4844 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 95 PID 3272 wrote to memory of 4844 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 95 PID 3272 wrote to memory of 4844 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 95 PID 4844 wrote to memory of 5000 4844 net.exe 97 PID 4844 wrote to memory of 5000 4844 net.exe 97 PID 4844 wrote to memory of 5000 4844 net.exe 97 PID 3272 wrote to memory of 3572 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 56 PID 3272 wrote to memory of 3572 3272 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe"C:\Users\Admin\AppData\Local\Temp\6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2956
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5000
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,18320353784098040629,17273168055569331828,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:81⤵PID:4348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 264KB
- SHA256 5ead7b2db6bd91ffa233801881641df6c7fc35e7c1f1606ebb0293780e909ab1
- MD5 21f41242248811873c1451b1bbf0abbb
- SHA1 85fe06af630b6d5b26f4e2686483cd2b21f21238
- SHA512 a8729dbc757312b7dbbcf975a3b395b2f7e0e7844110ea4d544d02a699bb6a90f9786273f26a9efc52b56ede0c2c7ee2a6ab19262c528f6a69eab4a5b3af6768
- SSDEEP 6144:K+aezigiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:K+aYitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 183KB
- SHA256 1b6f01b42c63eb45940ebb293681b7849a1acc37c16d8b7a8b76e3790d835dcb
- MD5 f295ba6212b94e26baca7e2d1bb427d2
- SHA1 bd841ce848437f3a15f5442e2518057a68515bc1
- SHA512 4d7bbfa0c6aad5d7a186815acf722f4bff5c8030baf39928824bdfd4d0046ef553a1ab950907afe8401819f2ba5440d2e7a7fd5e62a0af758a2f98860a1e4091
- SSDEEP 3072:HHe+aezUDbHXHDfByOpGjAvb3eLG2FmDDSrDVTFooWZet3:e+aezUpyOpGcj3UFmDDSrDVTSBQ3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 649KB
- SHA256 834cd914a6bc7c3eadf3b23bacc01433aa6a32411ab547d958604a1c434518b7
- MD5 1ad09ab121869e9bedf81b1e82331d05
- SHA1 21270e52207071b7d304acb7d776c9abba38c15c
- SHA512 4b1f28d726ec031fd0350a21ea7091087ae2688818716f7add7524fdf06a07d5937a4aa53c6029d2fab093714b1b48b8032927b56e2c207158946f6c71e6646b
- SSDEEP 12288:ml+aP5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:iBP5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3665033694-1447845302-680750983-1000\_desktop.ini
- Size 9B
- SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
- MD5 4f2460b507685f7d7bfe6393f335f1c9
- SHA1 378d42f114b1515872e58de6662373af31ab8c7b
- SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
- MD5 SHA1 SHA512