Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe
-
Size
70KB
-
MD5
c758781ba663c7e3085b8199ffbf73f6
-
SHA1
5d6eb6a4b7e17a1c9e736d332e1d8a9ea2859bb4
-
SHA256
38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56
-
SHA512
2b97b8671d36ecc074af9be048242f6dd206df0f48abe6dbdb017f5e2377eaaabeb66aaf7c5d43e152ba9937e777927e4ac40192bd03cab440a3ad0e724b8ac3
-
SSDEEP
1536:/BqQesrz8VuJlMXaDuiN3riw+d9bHrkT5gUHz7FxtJ:/Bqi8ulMXaK4rBkfkT5xHzD
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3828 Logo1_.exe 816 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Uninstall Information\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\images\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe 3828 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4748 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 84 PID 5064 wrote to memory of 4748 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 84 PID 5064 wrote to memory of 4748 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 84 PID 4748 wrote to memory of 4356 4748 net.exe 86 PID 4748 wrote to memory of 4356 4748 net.exe 86 PID 4748 wrote to memory of 4356 4748 net.exe 86 PID 5064 wrote to memory of 3016 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 90 PID 5064 wrote to memory of 3016 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 90 PID 5064 wrote to memory of 3016 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 90 PID 5064 wrote to memory of 3828 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 91 PID 5064 wrote to memory of 3828 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 91 PID 5064 wrote to memory of 3828 5064 38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe 91 PID 3828 wrote to memory of 3692 3828 Logo1_.exe 92 PID 3828 wrote to memory of 3692 3828 Logo1_.exe 92 PID 3828 wrote to memory of 3692 3828 Logo1_.exe 92 PID 3692 wrote to memory of 3020 3692 net.exe 95 PID 3692 wrote to memory of 3020 3692 net.exe 95 PID 3692 wrote to memory of 3020 3692 net.exe 95 PID 3016 wrote to memory of 816 3016 cmd.exe 96 PID 3016 wrote to memory of 816 3016 cmd.exe 96 PID 3828 wrote to memory of 1556 3828 Logo1_.exe 100 PID 3828 wrote to memory of 1556 3828 Logo1_.exe 100 PID 3828 wrote to memory of 1556 3828 Logo1_.exe 100 PID 1556 wrote to memory of 864 1556 net.exe 102 PID 1556 wrote to memory of 864 1556 net.exe 102 PID 1556 wrote to memory of 864 1556 net.exe 102 PID 3828 wrote to memory of 3452 3828 Logo1_.exe 56 PID 3828 wrote to memory of 3452 3828 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe"C:\Users\Admin\AppData\Local\Temp\38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD86.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe"C:\Users\Admin\AppData\Local\Temp\38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe"4⤵
- Executes dropped EXE
PID:816
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:864
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5c8b196f5407ab63d8caf057e262a457b
SHA1ce37375275204b5534bc8935435ae8e74d2c42e1
SHA25617e8f6a079b4b85c7f5e744ad48d598978d673670864e23436837ebe06d5d30a
SHA512ba07061e56bc827893ec47e7ca95a0fa0779fb26b2cb99fb4a990cd2e30fb90bc1c4ea9c720f8005315ceb3093aa5c405778c758ebb19e04e1d4cc7a5c58fa9e
-
Filesize
577KB
MD5e984536bfaf228a84e366f9e49733bd2
SHA1515f06c205395a2f01dd4181d33314d0a37b3657
SHA25619a7705d8e52b47a0ebbdb431b82829c31a862f30e0779861f032c13a5fa9a56
SHA5126e344bd6f727aac64c0e4e0878d7a5b750880fdeb8c4ef9c2e78cadf82d6cea703037108f74b141af46680eefdcbbec0172da15d5c815d23cba2234a94798f64
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5f9bda517f882e3c2636d44cfa30c8ef0
SHA106822afcd175307e76db635fa14c80b4708458ba
SHA256cb3149e29fc3c22b6ed7a427146780eb251e10b54153139535f6999b33037de8
SHA512e6c867020f86944f79cb768de9a01c60c36bbbf2937cf8cecb096ad578d06a2a37a3976665f2063da1e3e3be62ff26b520abe26d442e084e0b496d5ab08e1050
-
Filesize
722B
MD5a17cac9b6df5a88a5fcbb7b6bb0d5f5f
SHA144fae96cb6a32f77312be453e7ebe3f2914e819a
SHA256f7b940656a35856118853e2eef62c8b78dddb0aa132d2f1da3462dc63f6b98f0
SHA512616837948beaf0f9556f408b7d4cb6368ee8a73f3850e7f6b08c94a99af474505f2ff353d145e0ee5a57525fd6cfe4303c8541a34cb436eb5600a4c8652874f4
-
C:\Users\Admin\AppData\Local\Temp\38a1b6d3450929d69d2191e21d2f62f29e30a28f99e561121f8ca9b0cf299e56.exe.exe
Filesize36KB
MD59f498971cbe636662f3d210747d619e1
SHA144b8e2732fa1e2f204fc70eaa1cb406616250085
SHA2568adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
SHA512b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
-
Filesize
33KB
MD563f3782c5c4e2474a184e3891df996ad
SHA1727fa46bfd850377a4e53d9440aca6d573ad62a9
SHA256025c4d9b205d7003c44303a47e8bdb7f4b2a50ff1e02d7d28be74f5371059e92
SHA512ec501796a81c1f1f059e9e3f7882f184a9cf01af622f573f55c6ef4c1b3318a818aa93ebc8ecf358a948c39028957360588909255636ae296b6602bd8ba92329
-
Filesize
9B
MD5ee6da0916e43a13c40e1dec936bccc09
SHA13c41c332d37b563dad6d1c8ccec540428eae35f9
SHA2560259d8b67e15053053cf5d982948c58d2c6121d2f86b7aefa7c7948979c6e28c
SHA512b70fefd584ad9b4f8c71125a4be5e157cdcbccec18c7f64d235d10c98d4c6005b9c8b6261221211b48f5ceec417792d34750b488f0e2a33dfd702e0094f625a7