e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
Size

5.7MB
MD5

322bdbb545c5b5b068c9ddbc0fef6bfd
SHA1

240c4d2f5120f7461eedfeb3c556abe0baf0c3dc
SHA256

e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84
SHA512

206b4f150614fea7d8bdb99fce20aa75c9203a8cc4d06ee569c61e2d21a0122a32e6e40606daccabe725bf75051ed2cd66d72e60454aeda167744f6f3ca74fb8
SSDEEP

49152:zd+Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTP:zdAKUgTH2M2m9UMpu1QfLczqssnKSk

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
3620	Logo1_.exe
2168	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
File created	C:\Windows\Logo1_.exe	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe
3620	Logo1_.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4508	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	84
PID 832 wrote to memory of 4508	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	84
PID 832 wrote to memory of 4508	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	84
PID 4508 wrote to memory of 4668	4508	net.exe	86
PID 4508 wrote to memory of 4668	4508	net.exe	86
PID 4508 wrote to memory of 4668	4508	net.exe	86
PID 832 wrote to memory of 4936	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	90
PID 832 wrote to memory of 4936	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	90
PID 832 wrote to memory of 4936	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	90
PID 832 wrote to memory of 3620	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	91
PID 832 wrote to memory of 3620	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	91
PID 832 wrote to memory of 3620	832	e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe	91
PID 3620 wrote to memory of 4524	3620	Logo1_.exe	93
PID 3620 wrote to memory of 4524	3620	Logo1_.exe	93
PID 3620 wrote to memory of 4524	3620	Logo1_.exe	93
PID 4524 wrote to memory of 3804	4524	net.exe	95
PID 4524 wrote to memory of 3804	4524	net.exe	95
PID 4524 wrote to memory of 3804	4524	net.exe	95
PID 3620 wrote to memory of 3404	3620	Logo1_.exe	97
PID 3620 wrote to memory of 3404	3620	Logo1_.exe	97
PID 3620 wrote to memory of 3404	3620	Logo1_.exe	97
PID 3404 wrote to memory of 3572	3404	net.exe	99
PID 3404 wrote to memory of 3572	3404	net.exe	99
PID 3404 wrote to memory of 3572	3404	net.exe	99
PID 3620 wrote to memory of 3484	3620	Logo1_.exe	56
PID 3620 wrote to memory of 3484	3620	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
  "C:\Users\Admin\AppData\Local\Temp\e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF3B.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe
      "C:\Users\Admin\AppData\Local\Temp\e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe"
      4⤵
      Executes dropped EXE
      PID:2168
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
577KB

MD5
f9e02b402e6b05b48dde1a5978402742

SHA1
e3931f3bd9f3ee7effd6405485839ef5f6f9c0ed

SHA256
0fed2b31b1d95ba1f38c16065d9dcce285bb8d998e2695a539c60633969bffc7

SHA512
8a6c554ce167e46d7c6708075d6e0f0196400dcdea9fb3c5dc5d3a2d81da84f6ca314085cb940a3183e45c2411a820875ba58938836105b79f544c90b5e5c847

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
644KB

MD5
74f614352141ac4f78c3e59955ed2258

SHA1
179465d798ce029d20b16601530037ca9d87563f

SHA256
e33cff13b2b5307aaa06fc8f6d15ebe31eeb5ac6ad8d12b4b5c877eb34cca70c

SHA512
af736346b2a298b653dccc43a44d852001584bc22c5e00cb959246a0544044587e27ae3af6c253bf68b3dbe24a0badbe0bf55784f704d8e2f703afaed49ae6ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aAF3B.bat

Filesize
722B

MD5
cf4c3fe9ef874e75f880edc7f8407e13

SHA1
0e0d8051764ee7f8d8793b1572b09b3dca4b04a7

SHA256
414da86552eaba86f4024cdad62f61c0f1b0d95d34417973742403c8a8ac4951

SHA512
ff2e7b680bebddbde6d4a2466090574ec0ccb729734fe5ef3b01c63d75037050987822a5aab75707b566c7704f65672435885af9eca825889778e1adda526a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3f0b34a72badd765346ce4189e0724f355ebcf4f78e792c8a3ae71a6efedc84.exe.exe

Filesize
5.7MB

MD5
ba18e99b3e17adb5b029eaebc457dd89

SHA1
ec0458f3c00d35b323f08d4e1cc2e72899429c38

SHA256
f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

SHA512
1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
8b60374da6a287b6f74bf6f13d3e1f90

SHA1
fbd6a77ccc999577aa3fba55f3c51b14f69b9d69

SHA256
ed6b7410c5970a4c7a79c07a7e4e04ea8af10e0062a129740773824e33c84785

SHA512
25406024f25721e0ff62dc957641c5902e9c590d2599841195b92e2e7a7b041338d7e195df46c08e093d81ed3b66f099a3470f3f374dadf47772076b3825e43a

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
842B

MD5
6f4adf207ef402d9ef40c6aa52ffd245

SHA1
4b05b495619c643f02e278dede8f5b1392555a57

SHA256
d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

SHA512
a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1302416131-1437503476-2806442725-1000\_desktop.ini

Filesize
9B

MD5
9810b812fea5407a7c6a6b912eab6de9

SHA1
653710a103c34c6d87e85d547de48561b1579927

SHA256
497dc92fb09ed6740a1e704ddf5f45daf1d330f0977aaf1142604be15753e7ef

SHA512
a23126d1624a391a08931a8f98ec9c26bc5bbe75de0f111bcdbf17b5bbe9bc6e748ca58e52c96fb9ea80509d5ad1c90bf1d92e472b08b2532321106ba1aca2cd

Download Submit
memory/832-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/832-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-3218-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-8843-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download