f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
Size 1.3MB
Sample240613-a4lkeaxfle
SHA256 f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b
MD5 46b730eaf3f370f37af0dd3f43309039
SHA1 6a1496dfd1bd20f26d418e86d1a67fd644064fac
SHA512 c807255e1ff0dc7980aeaa488428eab35525ecad561792589c356c362d124013b727e4ee8d180dada58a7dbfa1e1bb13576c445c66bb9ef2822e6f60a378aaf9
SSDEEP 24576:eBZUR5kbjnCciOinOjLldsBjt8t2R8jpfZIg4mw6Ns/pZmBZOlnLyAuvTkM0XMXQ:eBZGILDcO/fsBmLjRw6qpZmBZWyLaXMA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 3 IoCs

pid	Process
1292	Logo1_.exe
4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
2404	msninst.exe

Loads dropped DLL 1 IoCs

pid	Process
4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\ModifiableWindowsApps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe
1292	Logo1_.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4764	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	81
PID 5000 wrote to memory of 4764	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	81
PID 5000 wrote to memory of 4764	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	81
PID 4764 wrote to memory of 3232	4764	net.exe	83
PID 4764 wrote to memory of 3232	4764	net.exe	83
PID 4764 wrote to memory of 3232	4764	net.exe	83
PID 5000 wrote to memory of 1520	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	84
PID 5000 wrote to memory of 1520	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	84
PID 5000 wrote to memory of 1520	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	84
PID 5000 wrote to memory of 1292	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	86
PID 5000 wrote to memory of 1292	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	86
PID 5000 wrote to memory of 1292	5000	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	86
PID 1520 wrote to memory of 4516	1520	cmd.exe	87
PID 1520 wrote to memory of 4516	1520	cmd.exe	87
PID 1520 wrote to memory of 4516	1520	cmd.exe	87
PID 1292 wrote to memory of 2232	1292	Logo1_.exe	88
PID 1292 wrote to memory of 2232	1292	Logo1_.exe	88
PID 1292 wrote to memory of 2232	1292	Logo1_.exe	88
PID 2232 wrote to memory of 4928	2232	net.exe	90
PID 2232 wrote to memory of 4928	2232	net.exe	90
PID 2232 wrote to memory of 4928	2232	net.exe	90
PID 4516 wrote to memory of 380	4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	91
PID 4516 wrote to memory of 380	4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	91
PID 4516 wrote to memory of 380	4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	91
PID 4516 wrote to memory of 2404	4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	92
PID 4516 wrote to memory of 2404	4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	92
PID 4516 wrote to memory of 2404	4516	f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe	92
PID 1292 wrote to memory of 4568	1292	Logo1_.exe	93
PID 1292 wrote to memory of 4568	1292	Logo1_.exe	93
PID 1292 wrote to memory of 4568	1292	Logo1_.exe	93
PID 4568 wrote to memory of 4536	4568	net.exe	95
PID 4568 wrote to memory of 4536	4568	net.exe	95
PID 4568 wrote to memory of 4536	4568	net.exe	95
PID 1292 wrote to memory of 3488	1292	Logo1_.exe	55
PID 1292 wrote to memory of 3488	1292	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
  "C:\Users\Admin\AppData\Local\Temp\f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5563.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe
      "C:\Users\Admin\AppData\Local\Temp\f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe advpack.dll,LaunchINFSection campaign.inf,DefaultInstall
        5⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msninst.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msninst.exe /Action:Wait
        5⤵
        Executes dropped EXE
        
        PID:2404
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4928
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 264KB
SHA256 5ead7b2db6bd91ffa233801881641df6c7fc35e7c1f1606ebb0293780e909ab1
MD5 21f41242248811873c1451b1bbf0abbb
SHA1 85fe06af630b6d5b26f4e2686483cd2b21f21238
SHA512 a8729dbc757312b7dbbcf975a3b395b2f7e0e7844110ea4d544d02a699bb6a90f9786273f26a9efc52b56ede0c2c7ee2a6ab19262c528f6a69eab4a5b3af6768
SSDEEP 6144:K+aezigiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:K+aYitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 583KB
SHA256 465180cf8ae7851bd9f0d9d3802cf252edefefb1846c1322bfab4a9bf7138ed5
MD5 84077a87183a7cb06546028816b7904f
SHA1 192f2e65f048c44d212d089814d6cbfda79c75d0
SHA512 9f9b0136a70cd24a540c3825694885334eb1e1dadf5e192bafdf2280befbef8c9746efa14e7d3059807a9a0ae64215eb41301dc4410411715e48917b81f8d2f4
SSDEEP 6144:e+aezDE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQL:e+aB7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 649KB
SHA256 834cd914a6bc7c3eadf3b23bacc01433aa6a32411ab547d958604a1c434518b7
MD5 1ad09ab121869e9bedf81b1e82331d05
SHA1 21270e52207071b7d304acb7d776c9abba38c15c
SHA512 4b1f28d726ec031fd0350a21ea7091087ae2688818716f7add7524fdf06a07d5937a4aa53c6029d2fab093714b1b48b8032927b56e2c207158946f6c71e6646b
SSDEEP 12288:ml+aP5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:iBP5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a5563.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5563.bat
Size 722B
SHA256 2d1ba6519c7a06f3c0d3a6bb752bcf85481ac335ef72caafeaf8ac208417e484
MD5 56d272468d6320ea3f909d702b72c851
SHA1 8ec3e3405285bb54946dd95deaf24888d4c21f1c
SHA512 b67b0d8aa4592762d3bafa7320339a820f2381ee44dbada24d971f20e655fe01b5de420b0dde805e5225418e031286ed5a28d6f85f85edbf44f951e688d24813
MD5 SHA1 SHA512

Submit Download

ADVPACK.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
Size 90KB
SHA256 06eed244d89f6e15205d5beb8085ac33c0de486dfe30eec9fb73b91de07e5f62
MD5 0ac28de5e930e8a52ad6b163c5473412
SHA1 25371c9d876959cb58b50c25ad709cf98dde45bb
SHA512 c2c82449927cac953668142a3f597c06626b0b3a26e8036de34e4ca1042a572fa3befa799d43fb24a1d23c821b5ed7994e3d211b6aaced15ba31d4639e96d877
SSDEEP 1536:Yoyomo1DLSaGi2aoIwPlL53Qtc1qpRBvgQbiSrvxekZCg0BUwTS9wpKSnZ0jJScy:z9J0I43QtcSRNgQnLx9ZCjGw8mZ0jJST
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsnInst.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MsnInst.dll
Size 244KB
SHA256 30714be137b7b648b0c3aa2a7410467289b53a8e2601f8c208a3613e1d31d0f0
MD5 8d26ec464de935561c221407c40cd4ac
SHA1 d7a729baa54a2aa8de08e0fe478c5c07cc490e55
SHA512 7d92bf3527c896b48f1e14e318fe086276cbd271b1d212965c87a75ad4ad4560c9e48d58f5138599695489bd3d759c577bedd4e9d7413522c7a16219dfb21de2
SSDEEP 3072:Nqiusvp8u2GczQ1/tDZ8fUT1LZ+0nlOSXj28g4Y7+g9L/+jJqXusCqgduZNg2ay:NnDKUtDRr+8YSiyYv96jJ7juI
MD5 SHA1 SHA512 SSDEEP

Submit Download

campaign.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\campaign.inf
Size 1KB
SHA256 80ed31ae5890469ee38fe7b950149e2f488344d892f1ef5ac3dc3e7ff3de2d6c
MD5 c4fb756abc97776beeb4ffa65303c843
SHA1 12b4e5c25a718020086608b72bf96b5bb513f8ed
SHA512 7695f79d44eb84fc08b2b7d8911916661db5ac4dbef91e77c9730ba84c576a1474cbcf18d9f155cd9ae2e74a0a33c88ed413c662a598dc045e1a6d246821be1c
MD5 SHA1 SHA512

Submit Download

iasvcstb.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iasvcstb.dll
Size 26KB
SHA256 ace81690c98cb396758dc016a76b77706924dd3a8598b3a0492bc12edb9af153
MD5 de63b3678f314fd74da0cf343c5860ae
SHA1 389bc0a0004feec9b089f993b1f9084716874b44
SHA512 43d63cdfcb5d2d96df0d0715ce24fdeed4fb8ef7e4530a640b5472c444a57e2045c3ef044a1f0c693c40d5c8d40eee4263010895d6c3b9101bd08c60baa76710
SSDEEP 384:VUoruFcFsf+CnQ2dTpmlWCa40QIfoGDygpWbFUntAreFpu10AYV6Uzn:akVVipmh0dOgpWhUnerl10Nf
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.mar

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.mar
Size 516KB
SHA256 2143c7a5aa2f9d321fbd902d80ac43f4fe9c684d2e5a55fbc686820e06261d9f
MD5 9229c34063391d37c7643ba38b5c4f09
SHA1 512b0b599b92fdcd35fc9571713947dd5978592f
SHA512 96847f62f94b2527ee03ae4699f219e1a1575190f622d98aee83c48a92839c49c188bf005b46bae49232376b59b39b5397d3569c64559def85b98582d1e00c62
SSDEEP 6144:4/P4/JXT9nX2qy+Q6IlFCstsF5NYCruYV016LGeqj/WdiOs2yIyX3XCX0sVhg9o:44/JXZ2pqEFCVFaQ0I5iOsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdbxi.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msdbxi.dll
Size 82KB
SHA256 2c2b10bb87662d1d61916784106a82cff510add0972112a9a14c03927b2d0846
MD5 d44eb3849bd5bab21356a41a94c8f868
SHA1 88273eb0af7657655df71d608fe93734b112559a
SHA512 d8d9f5ad1de64b584dc06cf683f8b83b2af99c57768898ed7b627c3ee9fbe13b17e7166e556378806026e7b2d21e1a299431044bac6e7125f0f090b7a26d3a57
SSDEEP 1536:oGmYGrHg3i9Kv+QpXxEnRYccAgnOpY3lxRtwN+ZP2lAPB:V1J3i9Q1pXxiYjacHQm2lAPB
MD5 SHA1 SHA512 SSDEEP

Submit Download

msnihc.mar

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnihc.mar
Size 21KB
SHA256 65118f920c6912e6a7dc6325698570fc7fa79beeb64d6204e6ca93f68ae0f692
MD5 64ec522096f2fd6f6258745e72215d8f
SHA1 471fc3fd3728b649beb4f4a8e4010f48846b834c
SHA512 691bd4e9016d97a87ac974d2ea8a6d6fd62bb3de6bceb257dad59df3a27c8d67b4b9524572a3ab9e9dd09c667a75e4a809fa83c2335900d58255edface015c93
SSDEEP 192:cmoVX/wfrL2yp/TavzpTWEXuauXGuJUMuduWdfDgeZd6ZadOEEjKKKq6hZh6qKKJ:RjL2gX4B2y
MD5 SHA1 SHA512 SSDEEP

Submit Download

msnilc.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnilc.dll
Size 31KB
SHA256 3f0e18479c7f8f75045d88605bbfa290663092464816739080b21b02d61f2588
MD5 82836e35011754a1738b25c4904e1137
SHA1 79e7b001ac214d9551562f8a1f4883b441a59502
SHA512 66aaef095440129d79c858e362241bd63f64a8074a08cadda37835ae91399bc490c490278bf51e84be1b7f427f8a11a2a20f97f6c969d431962f8719d1bcaeaf
SSDEEP 384:5hd9W5WGWd8kXCOOgpuG5wpDQK4Q8QCQijD8nT7qDGWYurI:531F8kyOO+uG5wpID8yDwurI
MD5 SHA1 SHA512 SSDEEP

Submit Download

msninst.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msninst.exe
Size 129KB
SHA256 66d7811a891b614f7fc174ae5a3ea1d29d1edde50b12fcaf51c0dc5b54a20b4a
MD5 c8e284efba3b50c9216dbe552d24f5b0
SHA1 c76b65dd211e03a2a53f57d87cc90df61b0ab10f
SHA512 42db8c59820836fee76ffc877983f72d639d9e30171943ae04d8cd8bcd4ac61730a5e0f4b80a905f4f59c03fa8ba62e1c8f4c1e9095eca65f17a2f122a688ef5
SSDEEP 1536:9wy7VZZ+fgFpGzlGEiwJgFL2Tl4xk8kXRXMMGBkyJMjZROYJT3bQghxHCZOX:9wk/LpIT6Klkk8kXRcaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

msnitd.mar

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnitd.mar
Size 62KB
SHA256 35f135fd9c04cdaf78bad191872cc1aa9cc38056f7c76ba29f0669be9e07210d
MD5 1ecf3b523c89ba2eb75c5ad8af347ebe
SHA1 d890967ddd05585c742d2ef18e4b0c5795db1334
SHA512 5fb8ca6245a033b12f234960223e146e743ccae7af73ecacb1a7d3826db656219f78242d49b5ee6d51cd5ae6f178b10c27ba3f6d6cdd9336590e4b1ccb5ad065
SSDEEP 1536:GO0SXfo0O4f1or9p7ShjYMf7MbRKcF4d/ShMhekKsm:TBew7MVKcF4d/ShMlVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

msnms.ico

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnms.ico
Size 24KB
SHA256 090ee05cef8113594959c4ba3d992eb1e5d2effb7f71ba8854adee27b8b6cf95
MD5 bca0ee599ffc56c533585e9026b3b58c
SHA1 ae5849eac5db2a69f09350fb455d50f16774290e
SHA512 5f7384af5a527f6cba3e8f04b5ab9314f1e8abbcbe4a3b57d2c8fa9939f926e8f7d64529dabd3912b1e41a95671ec4504f6a9c9ad341ef8e455371997863f2ad
SSDEEP 384:8ibWwIsXTT9h83OGXzYKDpFKti/xVnLk3hQ30:JWRsX9h83OGXz53DLShS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

msnsign.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnsign.dll
Size 746KB
SHA256 ccec6240c7a188e55156476d1bfcd06722c36bd7555f28845d747493529093d5
MD5 ffb0a9a7208b773c1fd469bec18a9185
SHA1 26a15559f6139eab67b76446f36d2ebdb87e569c
SHA512 9a019efb4d62f24ef979102e889c7aed6f49d213dbc362990ea2af8ec5957687e887883c234ee1026ebd20b4095209dfffa62da5f998d8ba0d29e75ed0a77bad
SSDEEP 12288:TLcUysz98+Cj5y5Ovcs527iiiiMpy+hgCY2CObztTsQ+VQu8XDlK0Z6dGNHc:PRTCAIL5zy+hgCY2C21h+hUlK0ZOG+
MD5 SHA1 SHA512 SSDEEP

Submit Download

msnsusi.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnsusi.inf
Size 5KB
SHA256 581a7e5bcf20a47f55e980b3b35e3881d72bb8c65f380857831906c9e6e332fd
MD5 9433366f4264f97cd01e7b29bb00bd94
SHA1 b064e88c8030cc986ac59c690e7eabc889541ce4
SHA512 aae48f610cdf02e30527a02ac83891505683e42ad5131029a18a4b1076912b10ddacee499ffecf5b24f95facb174afb920eb3de7ee4559a0250b0686da64404f
SSDEEP 96:wmuqbtuqbMQt/J7yQLGCw4xA4Xfb/gm2/gE+7UdaM308k0ZTNtcOkFgyWncEScSp:wmuqbtuqbMQP7yQvdxDb/gm2/gMq6Zh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicows.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unicows.dll
Size 239KB
SHA256 22f23cc65698741184ec34f46e6f69717644e0b5aabf5d5bd015101f2d72e56e
MD5 e1102cedf0c818984c2aca2a666d4c5f
SHA1 d8d88ea7083aee9c40f6fdc6c56451a018d21a83
SHA512 e58b35815801d6d3797f95c986834d2ca5450ccc3f1fa1d27d127a8d1d36f8e21279173715a00686c9c831d22d7c5b5b9cc5874170223a4d78f09c4eefa390a2
SSDEEP 3072:fEWAQKw38JvCAib0uT++ICSQ6UOX/mQhYQXS0FsmaiUZZynGJ5x/59XH7PMYV1Nz:qwgvCAib0PAOOQhS0/s5x/R1PkOFB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\f28120fbbf9ce1bab38412f9d9a3daa45d18a4a720abc077045af20443f1e93b.exe.exe
Size 1.3MB
SHA256 4ecd3f8b60c60870cdd67abf319b373c3438bb7bceac46209b2c87bd5e73a3f6
MD5 14a1e5a8cfef5f18b96540c1fb52ccb2
SHA1 5a0014e4a255c8be2fe3548bb32767bb05408ff0
SHA512 dc5113345692c1d6ad46fcade300d0e69613e37c6ff5a1cc5cf83bda2a5605f24890de89c22d218d319d9145dcddb37c4c50fcfd7e1cabd3750f18e9a4ce9096
SSDEEP 24576:NUR5kbjnCciOinOjLldsBjt8t2R8jpfZIg4mw6Ns/pZmBZOlnLyAuvTkM0XMXgPN:NGILDcO/fsBmLjRw6qpZmBZWyLaXMXWN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 39KB
SHA256 6ce51f68013320d84f843b0d21c772d7fe1316ae74987e719dbd96ad59fa2273
MD5 9f85e7536d590c9790216db83cd4226e
SHA1 4ba479e9e327319c546916f382b5dda9b0217973
SHA512 1ae9fc776270b6d45834dfc7c6648832df68a1016ae4456153e3fb7524cd190431fc2828dc7933ee2ccd9eac7a08c11e7697a3dcbbcde96d76335b1b08f292ea
SSDEEP 768:HHO5RroZJ76739AzUJQ+OYkLl2b3+DTQb9OGImt0o:HHe+Zk7qzUJBeLkbiT29dX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/1292-201-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1292-11-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1292-2969-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1292-8855-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5000-10-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5000-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download