Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2024, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
General
-
Target
1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe
-
Size
264KB
-
MD5
63393a2444718685acb3745e8a64fb23
-
SHA1
6aa5b519e7eecda9218730cdad2033b72ad48743
-
SHA256
1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201
-
SHA512
c95f501801182730e894ae0152a60b4ab93d31c4bd9b2c4cc76b2d0a73f06fcf7969d5a8399b31d58c62f11e75ead9ff843b95b03ca346143b990b17cce41483
-
SSDEEP
3072:20aY46tGNttyeQLYm1LLRkgUA1nQZwFGVO4Mqg+WDY:L46tGdye41LLRp1nQ4QLd
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3928 Logo1_.exe 4528 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Portable Devices\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Install\{4896B57A-BA2E-425E-ACC6-3260D1FD1C27}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe File created C:\Windows\Logo1_.exe 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe 3928 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4628 wrote to memory of 2284 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 84 PID 4628 wrote to memory of 2284 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 84 PID 4628 wrote to memory of 2284 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 84 PID 2284 wrote to memory of 1856 2284 net.exe 87 PID 2284 wrote to memory of 1856 2284 net.exe 87 PID 2284 wrote to memory of 1856 2284 net.exe 87 PID 4628 wrote to memory of 3892 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 90 PID 4628 wrote to memory of 3892 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 90 PID 4628 wrote to memory of 3892 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 90 PID 4628 wrote to memory of 3928 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 92 PID 4628 wrote to memory of 3928 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 92 PID 4628 wrote to memory of 3928 4628 1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe 92 PID 3928 wrote to memory of 4696 3928 Logo1_.exe 93 PID 3928 wrote to memory of 4696 3928 Logo1_.exe 93 PID 3928 wrote to memory of 4696 3928 Logo1_.exe 93 PID 4696 wrote to memory of 1596 4696 net.exe 96 PID 4696 wrote to memory of 1596 4696 net.exe 96 PID 4696 wrote to memory of 1596 4696 net.exe 96 PID 3892 wrote to memory of 4528 3892 cmd.exe 95 PID 3892 wrote to memory of 4528 3892 cmd.exe 95 PID 3892 wrote to memory of 4528 3892 cmd.exe 95 PID 3928 wrote to memory of 1684 3928 Logo1_.exe 97 PID 3928 wrote to memory of 1684 3928 Logo1_.exe 97 PID 3928 wrote to memory of 1684 3928 Logo1_.exe 97 PID 1684 wrote to memory of 3540 1684 net.exe 99 PID 1684 wrote to memory of 3540 1684 net.exe 99 PID 1684 wrote to memory of 3540 1684 net.exe 99 PID 3928 wrote to memory of 3368 3928 Logo1_.exe 56 PID 3928 wrote to memory of 3368 3928 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe"C:\Users\Admin\AppData\Local\Temp\1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC40B.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe"C:\Users\Admin\AppData\Local\Temp\1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1596
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3540
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD512ae904e74569a68eebba6b5fa332ec1
SHA136936bea76bc15ac1df1f90da70f9e7f74eeade5
SHA2567c6f6d6d8af55d5e4fbdefb6ffd78baf7b2055b79659cb8473a4510ea3888102
SHA512eef8275e6e9479aeb52ac482e60befbb08cd3f942d76f5addbf2c7576dd1f5077fcb4a69aacabcb4ab522696562740927ebf88b68c2ad438267b84224c9cc92e
-
Filesize
577KB
MD56eb333f16078465e06807d4fd33a4a08
SHA12ab507fe34452141dd64bf459767c896602e6676
SHA2560d44d38da05a975785ee86b35dffd6718e628f0f997dfb53266843a48885439e
SHA5123435806a08ce78687aff2087bdceda79110539738aa23d7ed265f8494cbcc881d49e6f4843cf0503b4677e7c84d2076d184a0eccbb77fcbd026ae6372393b36a
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD574f614352141ac4f78c3e59955ed2258
SHA1179465d798ce029d20b16601530037ca9d87563f
SHA256e33cff13b2b5307aaa06fc8f6d15ebe31eeb5ac6ad8d12b4b5c877eb34cca70c
SHA512af736346b2a298b653dccc43a44d852001584bc22c5e00cb959246a0544044587e27ae3af6c253bf68b3dbe24a0badbe0bf55784f704d8e2f703afaed49ae6ae
-
Filesize
722B
MD59b0eab9f39df5940a10158ed708be635
SHA1c846387f72837d86de6d9534825ef1addf380886
SHA25601bf2b9fa75325e691e5e505909c63742f56355f18f73ec5609123070660e90d
SHA5124de2447a587043f43fa383bbbfa1e056091e81d426e6fede84121fedc06be6091621a0180af246f23badd7d668f126a0a5fafe56d9d55d915f24df3bf1558e96
-
C:\Users\Admin\AppData\Local\Temp\1ccc8d004a0b8f62ee4b35065767e34afd54e04e5912eec28689301996dd0201.exe.exe
Filesize231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
Filesize
33KB
MD58d4ba3976a7a415a0421ddc3892b2358
SHA123adac0a985c6f21e7c0f3b8438c66847dd5e6f5
SHA256274f5f0e98244b78c0a68b40e70fcceb8b2de8d5039eb543a1973f3385288e8c
SHA51237af1aaa30199297df087716e5a39a762bd984775a50df4624f1b141aaac8035945d6faa162801f69f9e71063ad01de11f4da6232105c2ef8d32bf8133b64b37
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD50d72cd0b0aa46eeff2619cd2c58bf101
SHA15176d485e9a54ec517fd12c2aa7efcb1855286f2
SHA25648db671b8d392706b0784a38cfdbfc3e9090457cbb04901a9eed5e8248a76bb7
SHA512730ed8a629022a50a151646467a82228962c006a4fa23eadce4f586ef36df5fd311001c5ec502ddc4fe2e52b4f2a8da86e40950aefbcd51f8fd3dea8ebc304ba