Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe
-
Size
101KB
-
MD5
e8a6343198b3f5e31796a6d8fd520920
-
SHA1
c9b923ccd63d64ead621b9085da0aa96c962e270
-
SHA256
8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625
-
SHA512
26acd384b62b5583a17f5f44f10be417e32a81d37b5244cfb6a2ba192fc1c72a1d50c2fc4b3126d0af5226ae671cde82cc77f01a5c5b93795d0adb282e4fa8e7
-
SSDEEP
1536:JC/aYzMXqtGN/CstC9qVFJWtwXaa8NPI9j+RedcP01ic4Brg:JC/aY46tGNFC0VFJWtwXwKRj1EBrg
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2156 Logo1_.exe 116 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CABD97C1-51E2-44A0-88FD-F08955086650\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe File created C:\Windows\Logo1_.exe 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3392 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 85 PID 4936 wrote to memory of 3392 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 85 PID 4936 wrote to memory of 3392 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 85 PID 3392 wrote to memory of 3928 3392 net.exe 87 PID 3392 wrote to memory of 3928 3392 net.exe 87 PID 3392 wrote to memory of 3928 3392 net.exe 87 PID 4936 wrote to memory of 972 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 89 PID 4936 wrote to memory of 972 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 89 PID 4936 wrote to memory of 972 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 89 PID 4936 wrote to memory of 2156 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 91 PID 4936 wrote to memory of 2156 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 91 PID 4936 wrote to memory of 2156 4936 8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe 91 PID 2156 wrote to memory of 1164 2156 Logo1_.exe 92 PID 2156 wrote to memory of 1164 2156 Logo1_.exe 92 PID 2156 wrote to memory of 1164 2156 Logo1_.exe 92 PID 1164 wrote to memory of 320 1164 net.exe 94 PID 1164 wrote to memory of 320 1164 net.exe 94 PID 1164 wrote to memory of 320 1164 net.exe 94 PID 972 wrote to memory of 116 972 cmd.exe 95 PID 972 wrote to memory of 116 972 cmd.exe 95 PID 972 wrote to memory of 116 972 cmd.exe 95 PID 2156 wrote to memory of 1200 2156 Logo1_.exe 96 PID 2156 wrote to memory of 1200 2156 Logo1_.exe 96 PID 2156 wrote to memory of 1200 2156 Logo1_.exe 96 PID 1200 wrote to memory of 4432 1200 net.exe 98 PID 1200 wrote to memory of 4432 1200 net.exe 98 PID 1200 wrote to memory of 4432 1200 net.exe 98 PID 2156 wrote to memory of 3400 2156 Logo1_.exe 55 PID 2156 wrote to memory of 3400 2156 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe"C:\Users\Admin\AppData\Local\Temp\8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE80.bat3⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe"C:\Users\Admin\AppData\Local\Temp\8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe"4⤵
- Executes dropped EXE
PID:116
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:320
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4432
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD50ffb16d611b1daa68071fc21f317ad14
SHA12fd120012ad92d93c5088e8cea2ae9bacc782f2a
SHA25602bdc27c24f46efadb6ed3f5e323b13b154108837a11538dd1ab2e573c473bc4
SHA512b6841847df6596eba8f54e99dc30bca4b5dcb494310fb769222ec4bce52723a826f96f07e2ffcd0e5f7063c0c29df5c771dde0c160223e4be72900f0cc6d7ec3
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD50eec0543603f7a8ce8e8f5fee478e1d2
SHA1f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA256636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
SHA512cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
-
Filesize
722B
MD5cb76fa00e4e14f9644ed3f4c1bc7e03d
SHA1152ecca17c432c2f1f99778a789a3d74c95aee7e
SHA256fd52e96f50d7fdc9f0341144b086af8dbd191120ae7cb2a8282fa652aed38582
SHA5128bdb27e697bc6708d8e631a500f2878c098b79e347566cb4396d30038f5858e451718cccd3a14e11e53eefc8bd103cdc10c65c0e268e259ff42de6390aeb095e
-
C:\Users\Admin\AppData\Local\Temp\8b1c62e4867a9f5099f72a48c8529608547c188ddaafe4ef2432275e42ee3625.exe.exe
Filesize68KB
MD548335cfbe6a9bdaa2492ca1320b70a3a
SHA16d3c3d659e3718a0b56f52c9d4386d55d7672b97
SHA2564ec34f1d893e8cc02f669fb5eb329bbcc5374bd7e7284e8fd86fbc29d2ffeb4d
SHA5129eaf3b380449ab1d2b4b6371336fc71f6a43eee0295de012d0859e7f3b80a87f9d8316b0e65d4ca450630ee17b95c64e79e594bfe27fb3965917b0c5bc2d1b58
-
Filesize
33KB
MD5c7d0ac4daba2130b7198471cd0b488f4
SHA11508a062f2e1ce932b6db4fef2506ac8d0531566
SHA256e1c808d83a26f74b81dacc4e798c71ec055325ff7457111421b3a01f1b3286ec
SHA5122efe378391fd72e21c43c1976956559dd525c67a33e98f135731192d74acc21fab5ed4a71859aa6a7d31436d0c612cbe95015efc0a01dd75e1e2cb96359d65c9
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD576853822695e9314b90b205b5517a435
SHA1de6e48d84826cfcd19abbaa1ff3daddc8d825fbf
SHA256477608616359abe01b8ca52b48468a243766d1cc1569a285e6060139e5cd91d7
SHA51274fec6d54ce20fe2ae6ccf59b4fdf8b36d7e03b0576e7c6633c34ae3ceb7d2a0e0e36204cb76956e306ae263a779431df59aeb175a0a56750832c71a8fe98783