Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 09:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
General
-
Target
c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe
-
Size
963KB
-
MD5
9f6568df9df5cde5ecaac81c36afb291
-
SHA1
e6d21d558e7b46d19bad965685d962cfb77bd760
-
SHA256
c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb
-
SHA512
3a72c44e89c5afc3dd416c95a87f7a33befb5b13fa9cb422404a1a9c8179fd2effac64b51e9eac61192af9fcbec0d7e31068c47c735155ff0fe1987b3fc518cf
-
SSDEEP
12288:8RKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:BBpDRmi78gkPXlyo0G/jr
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4444 Logo1_.exe 1692 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateOnDemand.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\es-ES\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe File created C:\Windows\Logo1_.exe c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe 4444 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1692 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe Token: 35 1692 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2468 wrote to memory of 4484 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 84 PID 2468 wrote to memory of 4484 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 84 PID 2468 wrote to memory of 4484 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 84 PID 4484 wrote to memory of 4344 4484 net.exe 86 PID 4484 wrote to memory of 4344 4484 net.exe 86 PID 4484 wrote to memory of 4344 4484 net.exe 86 PID 2468 wrote to memory of 1028 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 90 PID 2468 wrote to memory of 1028 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 90 PID 2468 wrote to memory of 1028 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 90 PID 2468 wrote to memory of 4444 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 92 PID 2468 wrote to memory of 4444 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 92 PID 2468 wrote to memory of 4444 2468 c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe 92 PID 4444 wrote to memory of 1944 4444 Logo1_.exe 93 PID 4444 wrote to memory of 1944 4444 Logo1_.exe 93 PID 4444 wrote to memory of 1944 4444 Logo1_.exe 93 PID 1028 wrote to memory of 1692 1028 cmd.exe 95 PID 1028 wrote to memory of 1692 1028 cmd.exe 95 PID 1944 wrote to memory of 1500 1944 net.exe 96 PID 1944 wrote to memory of 1500 1944 net.exe 96 PID 1944 wrote to memory of 1500 1944 net.exe 96 PID 4444 wrote to memory of 5064 4444 Logo1_.exe 97 PID 4444 wrote to memory of 5064 4444 Logo1_.exe 97 PID 4444 wrote to memory of 5064 4444 Logo1_.exe 97 PID 5064 wrote to memory of 3480 5064 net.exe 99 PID 5064 wrote to memory of 3480 5064 net.exe 99 PID 5064 wrote to memory of 3480 5064 net.exe 99 PID 4444 wrote to memory of 3528 4444 Logo1_.exe 56 PID 4444 wrote to memory of 3528 4444 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe"C:\Users\Admin\AppData\Local\Temp\c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFA4.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe"C:\Users\Admin\AppData\Local\Temp\c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1500
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3480
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5f40a80dfe0fb38d4a62b29f10951b857
SHA1f714037242a7b4ce5553feff0ba7c591eedf8118
SHA2564a64ff29c51e9dee46008d046303e6d8cca5b37edc78cf18fdb513da48c3e26a
SHA5129d138a06a80b1c6c9bb022328bb44d4a94e38fecfcd6772f741569a31c3f46d02459818935b3d24de7ce403fb91b4c2d02d44ea932013c34242eec4b98d3e60a
-
Filesize
577KB
MD5de9f070e13f22428aa3a7692693da276
SHA197a4f0e29b8e4c4e411f74d71c3fbac4fcae6589
SHA2561853f0f5ba7f389941dbb94109f90c9a9463fd007abcc5e992218ae379cfba15
SHA512f246a74404b625cf8bba30df76a4a7dc5afe01ad1028bd1576aeec23491855a7459109cd1fc41a44edd182ce1d3c67f1d3d62e72ec33bede2a78e76136f0fc54
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD52fdcad374eb6488c8348009e911c64be
SHA10a8f2b05148a13b86d1943d3a928be129d90545a
SHA256476fbeec549dc6014272c301268996bd427ff2bba11868e8741f15ae3c029159
SHA5124015e13ed112f4d35c6ff54fafdeb465940dcd9e132d760778373d3a1e439d29a5e5ddfeaf20aade09b60a893efb243bd30b15deb3278a21c3e601937390feb4
-
Filesize
722B
MD5dca613d66968133d3fe1f98846cf1a3a
SHA1a79d561cfbe18c8ce65a2a03f69dde1397eed0b7
SHA256543812c7c4080222c39c20b8102608ef5fb932092ed0ea95dbf3af23dfa474ac
SHA5123846c510d56dfdfc41d592130a5f4dc4cea836cb9ff475b49c02bd274ba68a20590511bcece35ddf1279f56c129405e28ed439d525ec1eb2e914b0b31f625f5a
-
C:\Users\Admin\AppData\Local\Temp\c43c333e5caa6db50059203a8056b36f9bbafe829be60c07cf1f84e425c25fdb.exe.exe
Filesize930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
33KB
MD513020681bc352463cc9b9b81835adb87
SHA183d802b4c55d77c55fd8710d8d18d987253fadc0
SHA256b21a89ff79da20380e9b38ef53769de93841b69ad40321bfd671389ce6554a57
SHA5126f939b711c2a027fe0a2dd2645c7859e579282832c72656ede1f40e2fc706235771bb175cce287b404b89f7526ebe1188fdcbfc206722cbd748f3bfd1c4245c5
-
Filesize
9B
MD5c20162cff0e529974834e150d7e6691f
SHA1512e9821581354bd8078227ddf386b17e771ff38
SHA25682f2070eb6138ab12ec2a1f0c3ca7b3b97db75cc19a5076ed382b017f309bdd6
SHA512c2c414232ac5fc3d7ff195523c49610795d0ea4d95c69748ef9ddd4a42203ace52a7da8594cb20102743a21b6eb5bd9e7ee5915513a9c11a0db319323538d744