Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe
-
Size
399KB
-
MD5
8738894344c3386f626c3041d3fc6b59
-
SHA1
7de4c0e64a78b0cb28e2ef11de4d64c5726d8568
-
SHA256
93ecbe93753de092133b275826c68c53d3f42ea0ef963011cde6b94abb926fef
-
SHA512
73659f1361f0fa3fd6128cdfa559a273ce1ff303cc792a7e8613dc2b7cd683c947a01ca821b07437309594a34adffd1395271cdddaa44ad14ab7497b6d77d8f2
-
SSDEEP
6144:M1zU9A6TyE3ktD2OILj6c1EpQ+mpGS4nb3donAsT6n:M1zdyLbmpQ+AGSqbAq
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4308 Logo1_.exe 4588 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe File created C:\Windows\Logo1_.exe 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe 4308 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1660 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 84 PID 1320 wrote to memory of 1660 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 84 PID 1320 wrote to memory of 1660 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 84 PID 1660 wrote to memory of 3112 1660 net.exe 86 PID 1660 wrote to memory of 3112 1660 net.exe 86 PID 1660 wrote to memory of 3112 1660 net.exe 86 PID 1320 wrote to memory of 4144 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 90 PID 1320 wrote to memory of 4144 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 90 PID 1320 wrote to memory of 4144 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 90 PID 1320 wrote to memory of 4308 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 92 PID 1320 wrote to memory of 4308 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 92 PID 1320 wrote to memory of 4308 1320 8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe 92 PID 4308 wrote to memory of 5008 4308 Logo1_.exe 93 PID 4308 wrote to memory of 5008 4308 Logo1_.exe 93 PID 4308 wrote to memory of 5008 4308 Logo1_.exe 93 PID 5008 wrote to memory of 464 5008 net.exe 95 PID 5008 wrote to memory of 464 5008 net.exe 95 PID 5008 wrote to memory of 464 5008 net.exe 95 PID 4144 wrote to memory of 4588 4144 cmd.exe 96 PID 4144 wrote to memory of 4588 4144 cmd.exe 96 PID 4144 wrote to memory of 4588 4144 cmd.exe 96 PID 4308 wrote to memory of 908 4308 Logo1_.exe 97 PID 4308 wrote to memory of 908 4308 Logo1_.exe 97 PID 4308 wrote to memory of 908 4308 Logo1_.exe 97 PID 908 wrote to memory of 4508 908 net.exe 99 PID 908 wrote to memory of 4508 908 net.exe 99 PID 908 wrote to memory of 4508 908 net.exe 99 PID 4308 wrote to memory of 3488 4308 Logo1_.exe 56 PID 4308 wrote to memory of 3488 4308 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95A8.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8738894344c3386f626c3041d3fc6b59_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:4588
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:464
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4508
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD52a2e562abe0534f68a66b3dc9984378d
SHA16b25cf971ba93f972c9e9c4d21f3afbb8ba71c5e
SHA25600dda94f6f41e3a16e3bf696731064d5c8f48f43a1da9d7c203604d529eacfe2
SHA5124f9bec6145e60ab5416138e792b404c9fba2a2d5db20df1c3bb6d1276f501dc980084cc848c59afd84e4573e13ae723cb81ffbd37ab3bbb9cb919e4229f9608f
-
Filesize
577KB
MD5f065d8bf06243932f2701c5d8e62f471
SHA1f4c368d5ed70bc26028a00eb7590985f1a08adc7
SHA2565fe44850143aadadc040a84a8e4e6deec00c8861f06754f372c7aa90e2925c0e
SHA5121eb8a827b2500aa7fb1288dd80e7bc4969fb430b58f307b567f0742c0f1536c7162b8591bde017d0de5986fc528c861c14513c46589b15ceb158fc312ba0882a
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD536f84d53200fc76822ef4211fbaed20b
SHA106616547004b023d9b573d127e7b9c9590b7592c
SHA25631a2d373a9e3d8e1eaa79b7b9dcc8ad8d86bcb3741d99c68c6a8ddc67a00b5f7
SHA512efab63f312e660385c134b53dd549dc30209c12e909632e6d063309bb6d96048fbd7f4be523a6b38a8781c019ace4b176af1c39a3585d510d4736da90cccb750
-
Filesize
614B
MD5b184f295d62d161b8d7e7dbc078ceacb
SHA19f0d0f8966f9a96d97443d0e166f58d12bf82274
SHA25644732b8041f9432e266ba59807af6109d018a5916ed12bc4abf0b7c0a4353b33
SHA512a71f4c9a9db5600cfd6650a121b7c1531effba72e3c0283221b66fb70d7caf4ac10f605d4f1f7ee5202f5b66ed0038e3e11f5657a5fb1117df2007b6e1439631
-
Filesize
366KB
MD5697762d1a19bc975b53018c62af860ca
SHA17f9665190166fd8cd7dd87cbe65888cce181e880
SHA256571ec1ab427ce8a83409bbcd99d97781fac413520a42bb4687dce01f5b85c8b9
SHA512322b9ed23f06b56e801700a4cf5f86c9752e2bd329640559ead09abd638118de78bbc94b999075e2ae8e455bdef977f37347d99e87cfed42f2500842b0ae0176
-
Filesize
33KB
MD50c4fffce6aea3a78f2f91f0210054147
SHA17431ef60aeaf21a601fc22e0605c583e1b1ead69
SHA256542d5d5e03ae9271883efa6fc0b1a79a99c4f9b6ee7d414db5045e134537b776
SHA512905ed2a099daa8c8d2b3da6e5b9bb63ddf30081266a72c77f99c6b4fc1669684d479b30c5a31842e6daa6c5992ac00a12fc7bf562639805e34a0c2e1afbb95dc
-
Filesize
9B
MD57437d5296c0639dac402c56515b90619
SHA15b60f57442354dbfb4a5e6b3183a8eacbfeb6c19
SHA256a0c3017b092becae18571d22cd196109a5df6d4c3dee7b8c3f6baeb50a9e432a
SHA512747b6ee7f9161203144b94d7d135fc3ff23238af9a4cf3c0d40f615bd5c4bff5ef1f04c02d60b950fdd8ffb228766a8710d9c3de806c08a445b9b294152ab598