Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
General
-
Target
b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe
-
Size
963KB
-
MD5
a28c21369d1de3b4b9c843fad8217ae0
-
SHA1
88cbcec19b4ea5b1f6c4c102565aa56524410af7
-
SHA256
b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b
-
SHA512
21631265b8774d386ab7e99b81d4107b9f822e8331759050fc46dc94bec59a77fbf936e9c50f872f6455bc14f42baabdb39d664a3b047c01985cf1d172573a63
-
SSDEEP
12288:o1upbRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:o1AkBpDRmi78gkPXlyo0G/jr
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2728 Logo1_.exe 3408 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre8\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe File created C:\Windows\Logo1_.exe b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe 2728 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3408 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe Token: 35 3408 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4976 wrote to memory of 3884 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 80 PID 4976 wrote to memory of 3884 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 80 PID 4976 wrote to memory of 3884 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 80 PID 3884 wrote to memory of 1032 3884 net.exe 82 PID 3884 wrote to memory of 1032 3884 net.exe 82 PID 3884 wrote to memory of 1032 3884 net.exe 82 PID 4976 wrote to memory of 740 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 83 PID 4976 wrote to memory of 740 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 83 PID 4976 wrote to memory of 740 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 83 PID 4976 wrote to memory of 2728 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 85 PID 4976 wrote to memory of 2728 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 85 PID 4976 wrote to memory of 2728 4976 b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe 85 PID 2728 wrote to memory of 3612 2728 Logo1_.exe 86 PID 2728 wrote to memory of 3612 2728 Logo1_.exe 86 PID 2728 wrote to memory of 3612 2728 Logo1_.exe 86 PID 3612 wrote to memory of 5040 3612 net.exe 88 PID 3612 wrote to memory of 5040 3612 net.exe 88 PID 3612 wrote to memory of 5040 3612 net.exe 88 PID 740 wrote to memory of 3408 740 cmd.exe 89 PID 740 wrote to memory of 3408 740 cmd.exe 89 PID 2728 wrote to memory of 1056 2728 Logo1_.exe 91 PID 2728 wrote to memory of 1056 2728 Logo1_.exe 91 PID 2728 wrote to memory of 1056 2728 Logo1_.exe 91 PID 1056 wrote to memory of 4640 1056 net.exe 93 PID 1056 wrote to memory of 4640 1056 net.exe 93 PID 1056 wrote to memory of 4640 1056 net.exe 93 PID 2728 wrote to memory of 3540 2728 Logo1_.exe 56 PID 2728 wrote to memory of 3540 2728 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe"C:\Users\Admin\AppData\Local\Temp\b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49EA.bat3⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe"C:\Users\Admin\AppData\Local\Temp\b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5040
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4640
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5ded2175b2df67275abae4ba15944c7c6
SHA115e16af64183f29b566f558c36802e3e34e1205d
SHA2561e717899d86e8cf36ad797b533b4a43a58f9aba162dd8b4d4ee48ed6af64e16a
SHA5125d97130a356fd02f2837680b6d0b0d9c8e2ab37e6a167898acb29b44f35b7feb0d29f6dd2cde547255ba7e83e89ff9563edfe2f2781de84e4e99716c7a6a56b2
-
Filesize
577KB
MD52d835d4f8e8f55093949a011d2a13342
SHA10ab05f1fa9c2c53b2ac4d03d685cb0e460c68c58
SHA256f9d02843e907ee2ba15519e6fa504fb6e7f551dcaf7c631802cf51ff44939a9d
SHA512ebfe4e8e22baf2b77d4a23560da83da686d41eb67e50fe5c803d6c1fd464b56af2e041be84fb2ec3314ad107e04658ec591ee8fb21203bc9592bef18e7589b09
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD52186e704236b47c2268b5e251f696330
SHA1101fdc37baf83fed8f6f8b55f1594a13e5060c4f
SHA256ece9f7bb3d56dff6b865be7804d66254865ca7211619d517a7cf35cabba05144
SHA512f0b451724fe6aa486002e6c86951e0089f5bc6f7cca6cf3b0c9cc8fb55cec0e5ae428c5ce00774e7d71b6427261f37573ffe385cac023f213e438fc031fda806
-
Filesize
722B
MD5faf0a1b4cc1a945552b94f80eff687d3
SHA1f4c0870ccb44bac81f54873cd2b8cf098fcb30f4
SHA25682d0c3034f437b799d5ec239f70cff09ec8adcf38eb356eda11b02c633c3454b
SHA512792130f61b3854eb21d08d6468344224dc4d7b3c60671deafcf0534879e363fd375e2b9b931e8296c1ed985a7d99c4793db9b75428fea19a20960d54f5c484e7
-
C:\Users\Admin\AppData\Local\Temp\b88085518cc4ea1bbec6ca6e17b9660b04cf5a9055b0b379ce6024171aba8f0b.exe.exe
Filesize930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
33KB
MD502ae2f4f874cd3f8b010ee3e202c593a
SHA1bd9f1e0c977439f32db2d9368f2741eba46d68dc
SHA256b5a4af62bd47eb59cb99abef2d20aefc03881f37fbec23eb45a786ab9b889efe
SHA5128d93eff82209c4934b53f461d8730b9b09e0f353f272cbc4ea81b538f2b3e30eafbc5df8c30a27ba20d1a79a0204063f217f8bb0b4a9497ebb62bc91101ecd83
-
Filesize
8B
MD587cbd7a2d7bdb443a36ecfb46e39db18
SHA112aac09be13003e857809ea9434c76126ac39bbf
SHA256fe5e34894849bd441c429cfd17e62e06b828a82b04c9f0e7cadd884d78b326e1
SHA51275b0b484285909c577f97dd2b748e8b6e905b2a37dc8a569519325e67cac8b8932fbbd52c754df787e2a6326a9ca575e5d37372a9635718a310c642457ed17e0