Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
General
-
Target
79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe
-
Size
394KB
-
MD5
5551a37a1f0ec94f28f1fbdcaf69a27c
-
SHA1
c51c0776da0a8db87063ab5aa67ec6517dd516a6
-
SHA256
79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1
-
SHA512
3777077fa0bd00edfd928d8d3097d11f75efb60a774f6330d6cbc324e9b39298875bbeb9ec6aa5d0ce8ea4c3664e948ab6ada5f6bd7792ba05c4bf5c9fca4a58
-
SSDEEP
6144:B46tGdyR43P2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYK:B3NRvahVy41
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4772 Logo1_.exe 3260 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{E9FAE721-C42D-4B32-B146-9DE88A456C64}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe File created C:\Windows\Logo1_.exe 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe 4772 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4940 wrote to memory of 3160 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 88 PID 4940 wrote to memory of 3160 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 88 PID 4940 wrote to memory of 3160 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 88 PID 3160 wrote to memory of 4408 3160 net.exe 90 PID 3160 wrote to memory of 4408 3160 net.exe 90 PID 3160 wrote to memory of 4408 3160 net.exe 90 PID 4940 wrote to memory of 2932 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 94 PID 4940 wrote to memory of 2932 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 94 PID 4940 wrote to memory of 2932 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 94 PID 4940 wrote to memory of 4772 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 95 PID 4940 wrote to memory of 4772 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 95 PID 4940 wrote to memory of 4772 4940 79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe 95 PID 4772 wrote to memory of 620 4772 Logo1_.exe 97 PID 4772 wrote to memory of 620 4772 Logo1_.exe 97 PID 4772 wrote to memory of 620 4772 Logo1_.exe 97 PID 620 wrote to memory of 1772 620 net.exe 99 PID 620 wrote to memory of 1772 620 net.exe 99 PID 620 wrote to memory of 1772 620 net.exe 99 PID 2932 wrote to memory of 3260 2932 cmd.exe 100 PID 2932 wrote to memory of 3260 2932 cmd.exe 100 PID 4772 wrote to memory of 2940 4772 Logo1_.exe 102 PID 4772 wrote to memory of 2940 4772 Logo1_.exe 102 PID 4772 wrote to memory of 2940 4772 Logo1_.exe 102 PID 2940 wrote to memory of 3512 2940 net.exe 104 PID 2940 wrote to memory of 3512 2940 net.exe 104 PID 2940 wrote to memory of 3512 2940 net.exe 104 PID 4772 wrote to memory of 3464 4772 Logo1_.exe 56 PID 4772 wrote to memory of 3464 4772 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe"C:\Users\Admin\AppData\Local\Temp\79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD61C.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe"C:\Users\Admin\AppData\Local\Temp\79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe"4⤵
- Executes dropped EXE
PID:3260
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1772
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3512
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5f375599912a2c36d0b72cf3020d3428e
SHA11606bd6079148a8e09d9503a1af7863bf53aedcf
SHA256777b585caa9476ed69413784665a6cc0d5a2ea3f34f71711106e9e315c2667a5
SHA512c9dc90d8dd75d2b1180da634df5c7c7f91beb52959b2359ee7f83ee0346b835c7f24f610ff0da55b5129b3af883af25494a5fd0fbe464e3c1710083452b7b82d
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD52336e205ddd0c4d9247838f374602727
SHA12c44420262f81114d26c448757390a4df2af5d76
SHA2565940a191ed566bdad95563b25f34f057e76439ff5b9b7d39772f48ffdc19fa94
SHA512475e004ce77b1f161d95d280ffffec33e2f0bb820e42d13d03a6c8c7fa8a08afc2e0dbae1cc3aa81735434d4eab78171d4c231a3c01ceaea713f8bc89f9e05b5
-
Filesize
722B
MD5d5b0a0269448117b4a10efd5fdb651c1
SHA11dab6ffc013547fff94a87626d02124a14415c3d
SHA256e714127e5f802f7bae58b3ade57fe776b44017b63923919cf02de02a158d2ca1
SHA512931e8f1a1dc093508ba80d7a28e0b7f73cb328984311b6114bbc95f7dd5734430cc3139d3fd4bd8ec03934210eac3fca8371473b0bf9c5d7405badd15f212008
-
C:\Users\Admin\AppData\Local\Temp\79b669b8c50635f450e1fd5c1fe7043ab7536bd87deb86f3f3049c7bb88dfac1.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
33KB
MD5691f602e80b3386f1f5f218541fb2c32
SHA180e88565aa084a258f11e31a43268c3dd91e575b
SHA256bb46b91e5e9db669d5491ca06ac89d2139fe145e85554119d1060df2a8ec4a8a
SHA5121949232f7d263254dd65d5525cee2ecffb3377d6cfbe1f965f23bf7be65a145514b34524c37ff5c8fe5fc5ed2462d9e0ab169d5a443e42a0e4185be206ff8333
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD59810b812fea5407a7c6a6b912eab6de9
SHA1653710a103c34c6d87e85d547de48561b1579927
SHA256497dc92fb09ed6740a1e704ddf5f45daf1d330f0977aaf1142604be15753e7ef
SHA512a23126d1624a391a08931a8f98ec9c26bc5bbe75de0f111bcdbf17b5bbe9bc6e748ca58e52c96fb9ea80509d5ad1c90bf1d92e472b08b2532321106ba1aca2cd