Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
General
-
Target
f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe
-
Size
99KB
-
MD5
db68629a59c752586a2105e893d7f807
-
SHA1
bb35be8cbb9c8f539c714a4147e4da39769310b4
-
SHA256
f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944
-
SHA512
e228f062370444dba1308e7c8d5165f025a73d38a6d1ca8d78b84497aa9f99a1d5766ee7831051c170ccfa569bcbdb3f7e99e32b8dcc037295ac880f7104099e
-
SSDEEP
1536:HQae+Zk7qzUJBeLkbiT29dXkyapmebn4ddJZeY86iLflLJYEIs67rxo:HQae+aezUDbHXlLK4ddJMY86ipmns6S
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3648 Logo1_.exe 4816 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\Skins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\F283FAB0-91F5-4AC3-9894-058F553F83EA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\Visualizations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe File created C:\Windows\Logo1_.exe f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe 3648 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2228 wrote to memory of 912 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 84 PID 2228 wrote to memory of 912 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 84 PID 2228 wrote to memory of 912 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 84 PID 912 wrote to memory of 4204 912 net.exe 86 PID 912 wrote to memory of 4204 912 net.exe 86 PID 912 wrote to memory of 4204 912 net.exe 86 PID 2228 wrote to memory of 4552 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 90 PID 2228 wrote to memory of 4552 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 90 PID 2228 wrote to memory of 4552 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 90 PID 2228 wrote to memory of 3648 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 91 PID 2228 wrote to memory of 3648 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 91 PID 2228 wrote to memory of 3648 2228 f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe 91 PID 3648 wrote to memory of 3284 3648 Logo1_.exe 92 PID 3648 wrote to memory of 3284 3648 Logo1_.exe 92 PID 3648 wrote to memory of 3284 3648 Logo1_.exe 92 PID 3284 wrote to memory of 4384 3284 net.exe 95 PID 3284 wrote to memory of 4384 3284 net.exe 95 PID 3284 wrote to memory of 4384 3284 net.exe 95 PID 4552 wrote to memory of 4816 4552 cmd.exe 96 PID 4552 wrote to memory of 4816 4552 cmd.exe 96 PID 3648 wrote to memory of 4820 3648 Logo1_.exe 97 PID 3648 wrote to memory of 4820 3648 Logo1_.exe 97 PID 3648 wrote to memory of 4820 3648 Logo1_.exe 97 PID 4820 wrote to memory of 1656 4820 net.exe 99 PID 4820 wrote to memory of 1656 4820 net.exe 99 PID 4820 wrote to memory of 1656 4820 net.exe 99 PID 3648 wrote to memory of 3408 3648 Logo1_.exe 56 PID 3648 wrote to memory of 3408 3648 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe"C:\Users\Admin\AppData\Local\Temp\f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA180.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe"C:\Users\Admin\AppData\Local\Temp\f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe"4⤵
- Executes dropped EXE
PID:4816
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4384
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1656
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
583KB
MD58aa20031406a157d9a93a456a0e0aed7
SHA14496609ed6c85dee1e31a45b49aa3455e691d5a0
SHA256f57aa116f1956320282ba0203cfed6e35444b1998d2550955ad5a71f510862bb
SHA51265360b5494581261af227d16113aa7232f781ddcb7a8b27074075001f575faf0b1c036df7d6374be4d02a57799ed1fab5ae431e348ea884c6deb80dcce45f15a
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD51ad09ab121869e9bedf81b1e82331d05
SHA121270e52207071b7d304acb7d776c9abba38c15c
SHA256834cd914a6bc7c3eadf3b23bacc01433aa6a32411ab547d958604a1c434518b7
SHA5124b1f28d726ec031fd0350a21ea7091087ae2688818716f7add7524fdf06a07d5937a4aa53c6029d2fab093714b1b48b8032927b56e2c207158946f6c71e6646b
-
Filesize
722B
MD51ed37438d5eef90aa748a229fa57d5e4
SHA18a8095529ae9c2f82520e1cfafb4c7e0b4c961eb
SHA256113e8f606690a8aa001344c6338c9ff99f25e4b842b5849d792d270cbbacc77b
SHA5128006c22db834b9797752a1af969498ae714f7bd4547d6c0e0e151cab81a503b5fae0961b308e6da8eb0fc87f53f3afece89c2a5a5be5e73b46952e7aff8457cd
-
C:\Users\Admin\AppData\Local\Temp\f477eddb776bcd22c0885df4cd9035525e0641f0b32491254b96be96d4f5f944.exe.exe
Filesize59KB
MD5dfc18f7068913dde25742b856788d7ca
SHA1cbaa23f782c2ddcd7c9ff024fd0b096952a2b387
SHA256ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf
SHA512d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945
-
Filesize
39KB
MD50040a0ca5d99ddf58917a134d912e71d
SHA11a497605824da6f40f74a9aaa65406cbd6d3d6e3
SHA256326763efe5647b45477b4c84c26464720e4ba03a6ed1084f9db4b0c017ff96bc
SHA51276aedd078647935b61f32bf1cb7dc5869fcc1e5aeb8ce3fb1bd19d3ef7112959457156b64a0742685a1c792429733f5906265fcb4ddcac021aa8fab3516a63a2
-
Filesize
9B
MD52f0334867e3b4f3fc6afab89e6c60c0a
SHA1c85f48d89a0dbe33bb1bf28a7d368884324b2886
SHA2569c5fba8c43690fbd1f61110096e57ed14154d1714fea48699bd35a1339a35baf
SHA512ecb33a33a4301021c9977eceedbf47b567dba0b06541413c6ed19a5753eac29f5fcd7b0952535cfc3f911efe5d2827c797117b2a34640956591343690cc9e4fc