Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 07:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
General
-
Target
4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe
-
Size
258KB
-
MD5
301fb96070a21fb66dc325487aa8f01a
-
SHA1
52fb26384aa6458311d1d6b577dc5f3cd5ed5a74
-
SHA256
4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b
-
SHA512
7cb5ce09811df6155a44ff474d11ea6ebd569a0681338942f57a406ccb8e16da641831abfedc148c9119615f2fd71d3469195a640f5c1c1a41f5edec1f287078
-
SSDEEP
6144:B46tGdyR4PgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:B3NRritXqsTkiR7twRx+gD8PJ
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3180 Logo1_.exe 384 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe File created C:\Windows\Logo1_.exe 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe 3180 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4272 wrote to memory of 3932 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 86 PID 4272 wrote to memory of 3932 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 86 PID 4272 wrote to memory of 3932 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 86 PID 3932 wrote to memory of 4364 3932 net.exe 88 PID 3932 wrote to memory of 4364 3932 net.exe 88 PID 3932 wrote to memory of 4364 3932 net.exe 88 PID 4272 wrote to memory of 3916 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 92 PID 4272 wrote to memory of 3916 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 92 PID 4272 wrote to memory of 3916 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 92 PID 4272 wrote to memory of 3180 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 94 PID 4272 wrote to memory of 3180 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 94 PID 4272 wrote to memory of 3180 4272 4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe 94 PID 3180 wrote to memory of 2120 3180 Logo1_.exe 95 PID 3180 wrote to memory of 2120 3180 Logo1_.exe 95 PID 3180 wrote to memory of 2120 3180 Logo1_.exe 95 PID 3916 wrote to memory of 384 3916 cmd.exe 97 PID 3916 wrote to memory of 384 3916 cmd.exe 97 PID 3916 wrote to memory of 384 3916 cmd.exe 97 PID 2120 wrote to memory of 1768 2120 net.exe 98 PID 2120 wrote to memory of 1768 2120 net.exe 98 PID 2120 wrote to memory of 1768 2120 net.exe 98 PID 3180 wrote to memory of 2640 3180 Logo1_.exe 100 PID 3180 wrote to memory of 2640 3180 Logo1_.exe 100 PID 3180 wrote to memory of 2640 3180 Logo1_.exe 100 PID 2640 wrote to memory of 4900 2640 net.exe 102 PID 2640 wrote to memory of 4900 2640 net.exe 102 PID 2640 wrote to memory of 4900 2640 net.exe 102 PID 3180 wrote to memory of 3432 3180 Logo1_.exe 56 PID 3180 wrote to memory of 3432 3180 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe"C:\Users\Admin\AppData\Local\Temp\4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DFA.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe"C:\Users\Admin\AppData\Local\Temp\4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:384
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1768
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4900
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5f375599912a2c36d0b72cf3020d3428e
SHA11606bd6079148a8e09d9503a1af7863bf53aedcf
SHA256777b585caa9476ed69413784665a6cc0d5a2ea3f34f71711106e9e315c2667a5
SHA512c9dc90d8dd75d2b1180da634df5c7c7f91beb52959b2359ee7f83ee0346b835c7f24f610ff0da55b5129b3af883af25494a5fd0fbe464e3c1710083452b7b82d
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD52336e205ddd0c4d9247838f374602727
SHA12c44420262f81114d26c448757390a4df2af5d76
SHA2565940a191ed566bdad95563b25f34f057e76439ff5b9b7d39772f48ffdc19fa94
SHA512475e004ce77b1f161d95d280ffffec33e2f0bb820e42d13d03a6c8c7fa8a08afc2e0dbae1cc3aa81735434d4eab78171d4c231a3c01ceaea713f8bc89f9e05b5
-
Filesize
722B
MD58d891e1ed49ba8b38d117a0c7d3d7731
SHA1f5cd2805b232970de51fb90ae609f3833193bffb
SHA2567ad97b0f2e3595d596dc3b1096c20636f41ff4664582a688e10b4c13fa060a0a
SHA512d3147aa191d46d700491d9cc1ff5fc238beaec8261040efd1cbcb532606ac23e3f1488fe90049d23d9080f91a5ee6c7059f3006cbf4225df6becf92fbedbb484
-
C:\Users\Admin\AppData\Local\Temp\4ef49468db5c73e4f4591fe3bcaa1d4c5534324c2741370a126eb582cc3a650b.exe.exe
Filesize224KB
MD5d4b257c01bbaa68d15d8368475a4e227
SHA1fafae083a882e163cfa8c77258baaab891c17df2
SHA256dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546
SHA512167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502
-
Filesize
33KB
MD5691f602e80b3386f1f5f218541fb2c32
SHA180e88565aa084a258f11e31a43268c3dd91e575b
SHA256bb46b91e5e9db669d5491ca06ac89d2139fe145e85554119d1060df2a8ec4a8a
SHA5121949232f7d263254dd65d5525cee2ecffb3377d6cfbe1f965f23bf7be65a145514b34524c37ff5c8fe5fc5ed2462d9e0ab169d5a443e42a0e4185be206ff8333
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD59810b812fea5407a7c6a6b912eab6de9
SHA1653710a103c34c6d87e85d547de48561b1579927
SHA256497dc92fb09ed6740a1e704ddf5f45daf1d330f0977aaf1142604be15753e7ef
SHA512a23126d1624a391a08931a8f98ec9c26bc5bbe75de0f111bcdbf17b5bbe9bc6e748ca58e52c96fb9ea80509d5ad1c90bf1d92e472b08b2532321106ba1aca2cd