Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe
-
Size
397KB
-
MD5
790d0221d5f73ccd0e130c74d6da4509
-
SHA1
cc47b6f1e376d18e821d16190928c85eeb623b2f
-
SHA256
bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef
-
SHA512
f80603e466394e1b8da1053bef4408e07be673cce4e793cc7cf8ddc1b7bb71ffb9fb56eb2c337de9e53bbd7d1ba4b50adc173a4bb16533f023611e4db0fa4268
-
SSDEEP
6144:t1qe1ISynDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:t1quIFDXYJmSTZwYp32bY4qtDF
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2736 Logo1_.exe 2076 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Licenses\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe File created C:\Windows\Logo1_.exe bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe 2736 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3008 wrote to memory of 3204 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 85 PID 3008 wrote to memory of 3204 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 85 PID 3008 wrote to memory of 3204 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 85 PID 3204 wrote to memory of 1028 3204 net.exe 87 PID 3204 wrote to memory of 1028 3204 net.exe 87 PID 3204 wrote to memory of 1028 3204 net.exe 87 PID 3008 wrote to memory of 1600 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 90 PID 3008 wrote to memory of 1600 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 90 PID 3008 wrote to memory of 1600 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 90 PID 3008 wrote to memory of 2736 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 91 PID 3008 wrote to memory of 2736 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 91 PID 3008 wrote to memory of 2736 3008 bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe 91 PID 2736 wrote to memory of 4188 2736 Logo1_.exe 93 PID 2736 wrote to memory of 4188 2736 Logo1_.exe 93 PID 2736 wrote to memory of 4188 2736 Logo1_.exe 93 PID 4188 wrote to memory of 4292 4188 net.exe 95 PID 4188 wrote to memory of 4292 4188 net.exe 95 PID 4188 wrote to memory of 4292 4188 net.exe 95 PID 1600 wrote to memory of 2076 1600 cmd.exe 96 PID 1600 wrote to memory of 2076 1600 cmd.exe 96 PID 2736 wrote to memory of 552 2736 Logo1_.exe 98 PID 2736 wrote to memory of 552 2736 Logo1_.exe 98 PID 2736 wrote to memory of 552 2736 Logo1_.exe 98 PID 552 wrote to memory of 2176 552 net.exe 100 PID 552 wrote to memory of 2176 552 net.exe 100 PID 552 wrote to memory of 2176 552 net.exe 100 PID 2736 wrote to memory of 3428 2736 Logo1_.exe 56 PID 2736 wrote to memory of 3428 2736 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe"C:\Users\Admin\AppData\Local\Temp\bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe"C:\Users\Admin\AppData\Local\Temp\bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe"4⤵
- Executes dropped EXE
PID:2076
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4292
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2176
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5eabcd538f504610ed542dc20ec7662e4
SHA17e2511244c6dd3d004d76aa6c41423e4890e9009
SHA256d4d01768dd44f6b98cbff4b056f49c7a7121489fe389c8b7f7438d3716b6db8f
SHA512d1b9ae56ccc39a29bbc9710a81f8a953ec2b579d64c8e3a64341d2b34920ea30729ec060e9281fa474f46746f798c473f819bf5a423bee6e0b879687cffcb897
-
Filesize
782KB
MD501d2ee2bd5d05c626adef6dbd42002d8
SHA1ec677fc4cfdcca9510ef3221ad487caae745e6e1
SHA256a6ff43694fe8eaff00d2e5a107e36277b95d716b2eb54afb4ffdcf403bfbbed2
SHA5129b171df54e90fcba11d9c0d552748306351b5c90b1751394e3b6c2943a29030045628f2a0ffc01fa1aa644b4a7ee0e1a118056a63b40b9b159d2fc3f687518d3
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5ab2cb63e497f09bfe8be14bcf0f680b1
SHA1d116c92ed3c487a1dcde68e4e58e66a535627fe7
SHA256c60d34a999168bdce718de1e1e2642d8903fde2c2359e4850ca852995bc62739
SHA512f54fc6ad7bc41b97b6f600304f5e4cf7eddd733a018116282cf0b53c8b4a3b78b738011e70113420093320884099bc70908731e277e0369de0e7df67d146a21c
-
Filesize
720B
MD57063d707a0857a4752232c785682cd0b
SHA18e8c39cc69c7cfb893964e89cf8a21f9d7b094b6
SHA256f2b55d17a9538ed9da41c435b2408f4bad36eac29c6a513e5430662f2e02359b
SHA5121041c40edde948f9e19019d2e301982483d1e4042ec5b90487c1ce52f66ce23afea24995f012b7c5c68b409a8c4230d05400d55f187391712fb66da087c87021
-
C:\Users\Admin\AppData\Local\Temp\bdf03f55bf486ad0e8cc24a2cae4174991fd3b52761bd46d256276fee5e2c6ef.exe.exe
Filesize364KB
MD5213eeb5e8f54231f68e5b26a0fc81bd1
SHA11bc31a42536eacbb57d1cd92ec4b5524a82264d2
SHA256b309045509efc205eb35d6037d64640093fde6c54ec5934e329b447417005a50
SHA512ce35c5f453126c98329df141f821c55692f9252549c76921c231d8170df356cda1689e636758519c0b6898f11b5c836cdb4967d296b99f915e4d1980470a083b
-
Filesize
33KB
MD5e66ec81a55072abc67e5c48adc2f771c
SHA1b7b45b11de92fafe2ccd0c5a0a1a1d24991eba5a
SHA2566a9fa6177b7f71bfa63a0274a9832d18bfecbdc663bf23e1580203a5456b8a90
SHA512097f9f98618b195a7af7814e7eddba5ce1c25bd3a0d7818e79b4dfda1d6d20b08b0f28dec64278015a62fd5a3bf7495ae2d65ccfa1c48fc7a30a6eb3d9cd8287
-
Filesize
9B
MD5c20162cff0e529974834e150d7e6691f
SHA1512e9821581354bd8078227ddf386b17e771ff38
SHA25682f2070eb6138ab12ec2a1f0c3ca7b3b97db75cc19a5076ed382b017f309bdd6
SHA512c2c414232ac5fc3d7ff195523c49610795d0ea4d95c69748ef9ddd4a42203ace52a7da8594cb20102743a21b6eb5bd9e7ee5915513a9c11a0db319323538d744