Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
General
-
Target
95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe
-
Size
97KB
-
MD5
16c80b6f575597f508be71a22bd6d213
-
SHA1
c3870d87a2d6d288cd29ef411188da19caae9cad
-
SHA256
95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6
-
SHA512
18ccad09245e0e4e6172fd6aec6eaf8a84ee0e8629a00eb05d8513a8244ca0ec49a455a9c0c770f45395ea608a9ce3a97dce29b36b6710b371c4cc813d497a58
-
SSDEEP
1536:eFcx1ae9n40g9i/qo6SKHXf88qP2CsRdxgwGGCIOunToIfiWdN:eFfZQioJK3f8l2CHRGgKTBfik
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4560 Logo1_.exe 3692 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe File created C:\Windows\Logo1_.exe 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe 4560 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1468 wrote to memory of 4888 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 86 PID 1468 wrote to memory of 4888 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 86 PID 1468 wrote to memory of 4888 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 86 PID 4888 wrote to memory of 5000 4888 net.exe 88 PID 4888 wrote to memory of 5000 4888 net.exe 88 PID 4888 wrote to memory of 5000 4888 net.exe 88 PID 1468 wrote to memory of 1304 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 92 PID 1468 wrote to memory of 1304 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 92 PID 1468 wrote to memory of 1304 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 92 PID 1468 wrote to memory of 4560 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 94 PID 1468 wrote to memory of 4560 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 94 PID 1468 wrote to memory of 4560 1468 95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe 94 PID 4560 wrote to memory of 4284 4560 Logo1_.exe 95 PID 4560 wrote to memory of 4284 4560 Logo1_.exe 95 PID 4560 wrote to memory of 4284 4560 Logo1_.exe 95 PID 4284 wrote to memory of 4180 4284 net.exe 97 PID 4284 wrote to memory of 4180 4284 net.exe 97 PID 4284 wrote to memory of 4180 4284 net.exe 97 PID 1304 wrote to memory of 3692 1304 cmd.exe 98 PID 1304 wrote to memory of 3692 1304 cmd.exe 98 PID 1304 wrote to memory of 3692 1304 cmd.exe 98 PID 4560 wrote to memory of 1924 4560 Logo1_.exe 101 PID 4560 wrote to memory of 1924 4560 Logo1_.exe 101 PID 4560 wrote to memory of 1924 4560 Logo1_.exe 101 PID 1924 wrote to memory of 4036 1924 net.exe 103 PID 1924 wrote to memory of 4036 1924 net.exe 103 PID 1924 wrote to memory of 4036 1924 net.exe 103 PID 4560 wrote to memory of 3472 4560 Logo1_.exe 56 PID 4560 wrote to memory of 3472 4560 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe"C:\Users\Admin\AppData\Local\Temp\95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe"C:\Users\Admin\AppData\Local\Temp\95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe"4⤵
- Executes dropped EXE
PID:3692
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4180
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4036
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5e3b8ef4f691ddcc7936415e89be83583
SHA187ef1e48cb29be9f8bc8d8a7d37e58f7b78e0d6d
SHA25652044f9468d832bf9a0d32672e67cefbf8b7f5f6e13468090ed447868e5d4b02
SHA512e1b2b2f4d55cf6ebffe7dd862508436e7a2feb6ba8dc73960bb83905f33002409730b9f77de382589f5805c81075254c26d3e0887e91d1b0e48ddb319d8fff2e
-
Filesize
577KB
MD57658c9c47ef2805682a3b682465720db
SHA1f12ac645874395e5aa0b0140faecef4119554c3b
SHA256a7463ce4b4a0cb0128fef035b8069caa9d8530a3d797b6615f80acc87888de28
SHA512458b86000db315100ce26668cf8b70ad38f543751fa8a7d666fc9c611f3d3c42303400f1ed4314986e9ea7eec0c9c70db9d020f06725440df4d52dcb5e4f2b40
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5c08994604c02bf7431e4c46295a779d5
SHA17f526582e292083589253bbc8b2cd093b2229ff2
SHA256218bfecab8804a634b05ebcedc30eab7aa8fa8ed5775495ba9545517c311f00e
SHA51213d9b746d0fe6922ecff9b5bf0ac896a63da11610341d4a7701e2a8d8fc5c0511d7bd9f4f54d3756b770998601b4f7b39b7e5c36d824dd42470fb0b499065c34
-
Filesize
722B
MD56aec3709ecf19ffc9a2e7683158fa50a
SHA1fc6be58297b46b98da6cc94b5ac344755e2757ae
SHA2565ec8d1e2cf1789ec6ff0e1681c85ce776eba92a37c70dfd5aaf12019b9630724
SHA51230899d53a9c57906b83ca39cf50d5cf37f267049e45663a4a524ec13dd919abbefdff3b7944f44dedc66f9a7a78af7ce7a673de7f39cdaf095d03812795365cd
-
C:\Users\Admin\AppData\Local\Temp\95eea0009ecd7edd6f5dcad51bcbc0bf909b0850c73b807dfd937c6357ae4ab6.exe.exe
Filesize64KB
MD5ae6ce17005c63b7e9bf15a2a21abb315
SHA19b6bdfb9d648fa422f54ec07b8c8ea70389c09eb
SHA2564a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e
SHA512c883a5f599540d636efc8c0abc05aab7bad0aa1b10ab507f43f18e0fba905a10b94ff2f1ba10ae0fee15cc1b90a165a768dc078fda0ac27474f0eef66f6a11af
-
Filesize
33KB
MD5117c9521e5d8959b1861c9511c792fea
SHA18b69af116f9b988e45371c811cbddbadcc067e44
SHA256ec905c17086effa5331a07e7805a26bbe62d94c5e90f5fa55a45c668061285de
SHA51293b85bf1c95bdb8781ff90f88faa4b8a0945067be93390b87ee7ab5830b17b257422cfcfcd87078c5004510e2b553876070813a55faaa578e0b979576a2c0eeb
-
Filesize
9B
MD55e286801abdc6ca5d3091665a72ecd7c
SHA187e0b4601ab0b05784a1059a45d72d807b0e2cbb
SHA256131ccc46b756e5373dc2f2d37625bfb980a48f2f2287585da364166cf2e709b5
SHA51251506d6adb68cca9e21fcddfe9672b91352cdb4f3c5b8c2da40219c73d2e7724776cd8701ff68449720c0aa398fe4f7665dabae2bd5147d42c5b6882c99f0bf1