Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 04:55
Static task
static1
Behavioral task
behavioral1
Sample
73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe
Resource
win7-20240704-en
General
-
Target
73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe
-
Size
33KB
-
MD5
820143c947ab5434bd7b8c34ba5dc5eb
-
SHA1
a5a2bf184cd3660354e5737bf3fce81b4ad48617
-
SHA256
73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff
-
SHA512
291081637d5f02a2b72d566ebca598b41f5eb080231923523b221f1e2a770341c1b73c3f3115c70018b30fef74e89738db4d670741a4eade1fadd9a5ca9e211e
-
SSDEEP
768:JTJYmMUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JT/aYzMXqtGN/CstC9qVF
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\X: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\L: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\U: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\T: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\O: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\K: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\G: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\Z: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\V: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\R: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\P: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\J: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\I: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\H: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\W: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\S: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\Q: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\N: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\M: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened (read-only) \??\E: 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Uninstall Information\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Adobe\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Google\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\DVD Maker\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Uninstall Information\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe File created C:\Windows\Dll.dll 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1728 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 29 PID 2152 wrote to memory of 1728 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 29 PID 2152 wrote to memory of 1728 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 29 PID 2152 wrote to memory of 1728 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 29 PID 1728 wrote to memory of 1048 1728 net.exe 31 PID 1728 wrote to memory of 1048 1728 net.exe 31 PID 1728 wrote to memory of 1048 1728 net.exe 31 PID 1728 wrote to memory of 1048 1728 net.exe 31 PID 2152 wrote to memory of 1688 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 32 PID 2152 wrote to memory of 1688 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 32 PID 2152 wrote to memory of 1688 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 32 PID 2152 wrote to memory of 1688 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 32 PID 1688 wrote to memory of 2904 1688 net.exe 34 PID 1688 wrote to memory of 2904 1688 net.exe 34 PID 1688 wrote to memory of 2904 1688 net.exe 34 PID 1688 wrote to memory of 2904 1688 net.exe 34 PID 2152 wrote to memory of 1212 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 20 PID 2152 wrote to memory of 1212 2152 73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe"C:\Users\Admin\AppData\Local\Temp\73141311c62e269e0c546e341d6c30030defdc3c2d893b0bcb36e77c0ca144ff.exe"2⤵
- Drops file in Drivers directory
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1048
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2904
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717KB
MD59d0b5b2173909aa831f5c2ef2da67f85
SHA198dc68e36f7251fc30306647bfd73bf19cf52538
SHA2566a860d739c1f97ff8411bde9992dbc0bc6289af179dea6edd1d5f394096da220
SHA5123187054b746c8c445a89dff0006a3293ba25b47f9b207f1eaa89455573f3e4b8d6fe22d3896cd4e7f55b35d7875528d9c122f3e471267724bd9fcb3ca78584e1
-
Filesize
478KB
MD577ec999dc753d70d4a8fbc32a98efb2f
SHA1172ba524961356c8cf218baf27e14c66a07ffefc
SHA2567178ea26cd9a2cd05e48e5d856a330d3e276d798d14aa10852df737f141dfbc5
SHA51267d6a5f5034c44c4dbd5df9f61dc7754a1981040f04e2bd8159b8311f9b57009d731ac051a7751ff4674817f3d6f2c3fb5537046a289f45ca038d10084b6bd58
-
Filesize
9B
MD51368e4d784ef82633de86fa6bc6e37f9
SHA177c7384e886b27647bb4f2fd364e7947e7b6abc6
SHA25657507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772
SHA5123cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b