990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
Size

29KB
MD5

4090e8e16284b5e25cb91af9158b9a02
SHA1

80fb44c3e6a13cd7ce56b7fda213a58098bd1c65
SHA256

990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787
SHA512

7945149be5fd2c5e4f36fb7962816a24a29c3828896e513e8f02088b5a610d13cf99ac1b66bf5831271a3ada03618919605c318815091e44c09931177aac5a58
SSDEEP

384:NbbJ0U1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:puU16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\T:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\I:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\S:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\L:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\E:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\W:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\Q:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\K:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\J:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\R:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\P:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\O:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\N:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\Z:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\Y:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\X:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\U:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\M:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\H:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened (read-only)	\??\G:	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Google\Update\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\View3d\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4324	1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe	91
PID 1432 wrote to memory of 4324	1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe	91
PID 1432 wrote to memory of 4324	1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe	91
PID 4324 wrote to memory of 3688	4324	net.exe	93
PID 4324 wrote to memory of 3688	4324	net.exe	93
PID 4324 wrote to memory of 3688	4324	net.exe	93
PID 1432 wrote to memory of 3492	1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe	56
PID 1432 wrote to memory of 3492	1432	990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3492
- C:\Users\Admin\AppData\Local\Temp\990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe
  "C:\Users\Admin\AppData\Local\Temp\990c9afe4c6bbb6e9922fc40da5496fcae311fa0e9fecdd5faf5dc4c21552787.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
173KB

MD5
80f4ad08cafbca4cb212b9a9d817c56a

SHA1
4b3f7114e03d66444edcf7e4c0c1ea87afda5ff4

SHA256
1ae5a8e1fbfed7a17fe838ae8d5734dac7e52e7fecc52ddd147c1e28b2ae2adf

SHA512
a1f292eebe8287f5e27d5f329f80bc32b72c30465dfb16dc6646bad16f9ea3a4938016b5b7ab893105457c9afb3a7d48fff3f192c1a28caaef72101b4fd6045a

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
c6d6354b442f8417dc66b1723a800f2f

SHA1
94525ba06431ca98c5b8b58c60b24ac8811b1748

SHA256
848e14757895f1da1da61c8bb06127caaeb36eb3361768b3baf1a7974ad16716

SHA512
49b347afad74e96aeedddaaf3bbf7cb261c5590b4991af35f3fcd5fe2a22954266e5dc84b100590731da608ba49aa04fd5f22c7997d20ca5999cc63103180a5f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2170637797-568393320-3232933035-1000\_desktop.ini

Filesize
9B

MD5
ee6da0916e43a13c40e1dec936bccc09

SHA1
3c41c332d37b563dad6d1c8ccec540428eae35f9

SHA256
0259d8b67e15053053cf5d982948c58d2c6121d2f86b7aefa7c7948979c6e28c

SHA512
b70fefd584ad9b4f8c71125a4be5e157cdcbccec18c7f64d235d10c98d4c6005b9c8b6261221211b48f5ceec417792d34750b488f0e2a33dfd702e0094f625a7

Download Submit
memory/1432-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-396-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-1225-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-4850-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-5307-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download