Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe
-
Size
251KB
-
MD5
59086294a275f8ad0928bca367937158
-
SHA1
969cb1754a300380cada3e38d93277f01bffa4bf
-
SHA256
83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495
-
SHA512
0086fa7291bba356c850e3e96aa20eb22582163f2316241c1f8006711f68eb63cf2ab087605fa097634ef2ec33b44bab91080d66008de2c30ac0bcc61c8021e8
-
SSDEEP
6144:A+aX3LxQZbO5JCSZT0wwla4G13CmdxLzI9LTB5xnmT:A+aUbuJcfcXbz0Tfxo
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4384 Logo1_.exe 4032 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe File created C:\Windows\Logo1_.exe 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe 4384 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2316 wrote to memory of 3208 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 86 PID 2316 wrote to memory of 3208 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 86 PID 2316 wrote to memory of 3208 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 86 PID 3208 wrote to memory of 1912 3208 net.exe 88 PID 3208 wrote to memory of 1912 3208 net.exe 88 PID 3208 wrote to memory of 1912 3208 net.exe 88 PID 2316 wrote to memory of 2440 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 92 PID 2316 wrote to memory of 2440 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 92 PID 2316 wrote to memory of 2440 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 92 PID 2316 wrote to memory of 4384 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 93 PID 2316 wrote to memory of 4384 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 93 PID 2316 wrote to memory of 4384 2316 83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe 93 PID 4384 wrote to memory of 1528 4384 Logo1_.exe 94 PID 4384 wrote to memory of 1528 4384 Logo1_.exe 94 PID 4384 wrote to memory of 1528 4384 Logo1_.exe 94 PID 1528 wrote to memory of 4516 1528 net.exe 97 PID 1528 wrote to memory of 4516 1528 net.exe 97 PID 1528 wrote to memory of 4516 1528 net.exe 97 PID 2440 wrote to memory of 4032 2440 cmd.exe 98 PID 2440 wrote to memory of 4032 2440 cmd.exe 98 PID 4384 wrote to memory of 3112 4384 Logo1_.exe 100 PID 4384 wrote to memory of 3112 4384 Logo1_.exe 100 PID 4384 wrote to memory of 3112 4384 Logo1_.exe 100 PID 3112 wrote to memory of 2532 3112 net.exe 102 PID 3112 wrote to memory of 2532 3112 net.exe 102 PID 3112 wrote to memory of 2532 3112 net.exe 102 PID 4384 wrote to memory of 3456 4384 Logo1_.exe 56 PID 4384 wrote to memory of 3456 4384 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe"C:\Users\Admin\AppData\Local\Temp\83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD68A.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe"C:\Users\Admin\AppData\Local\Temp\83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe"4⤵
- Executes dropped EXE
PID:4032
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4516
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2532
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD571ba7af50c95582d5533b66cb35dd83a
SHA1e04b58f7ee8b0ca9ef148ec1e10d088047f867ab
SHA2561ea29a665f9812577876ba26bd78ba674c2db7f4595a40d75b1dd8cd822a936b
SHA512031a9dffc539f40f0fe328c92b5a1610411f60dab96929d5eeb32018bbc754940cfb844d55becf9647a038dbf6fa885aecf6dcab8604434ae7cab5396cc1df15
-
Filesize
577KB
MD55ac4056f9d0b3bd588671434ead1c17f
SHA19d3e0e6c41fe202d78ac7adc0c26c0a5d27b5d9c
SHA256ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411
SHA51212955c0c491b2f4b5343ba8d64ac9c08eaa77cb5b84929b36fd9efde7e241dd1553d3175fb39d1f4f9a9cb9e1242f501df3943788977fb06b0d30871ba5330d2
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5a5d877ddb05e13f657da9a470f10bd7c
SHA10e06863bb66b72b01d0120f89a176a13ffccc6cc
SHA2565fba16468f3e99ea99a8b3007a6d4a34ddcbedcf757c192f0eaf707297414777
SHA512aa28dca40bbc144f40dec11b83cbb4ed746f3f74c831318c2eea0d5d4108ed6452485f30ab7f697114e19b48d4b256580042a542ebd65dacacea5e5384f600ed
-
Filesize
722B
MD510283e4523c1915c8b13357e55922322
SHA119e56a47ed00ff56647626fd06a408a7021ae042
SHA256f70df5ea3cfd8e1215badf66b1b07b05ca71b1b01d678ddbc6a23688dc45b988
SHA512d97b87a6f9b3d680e1e466055a6675cf76464002bac494da49ef0c008934e8f7a0bc36a6ae00ddebdbdde4e251027c3efb4053ae3957588922f3dfa635122d69
-
C:\Users\Admin\AppData\Local\Temp\83a7d67281eb45851a02743bf1f8b3a2c3846f783c3607862d324b173281c495.exe.exe
Filesize218KB
MD55f1707646575d375c50155832477a437
SHA19bcba378189c2f1cb00f82c0539e0e9b8ff0b6c1
SHA25675d348a3330bc527b2b2ff8a0789f711bd51461126f8df0c0aa1647e9d976809
SHA5122f55dd13abfeb5af133ac5afb43c90fd10618e8fb241f50529241cff7987fff382cf151146855c37ad8ae0401b34f6d9aa32cbec03cdd67a224dfe247bad6c99
-
Filesize
33KB
MD5c4ec2631f0913b349423b6d2bd687a6b
SHA19b9ae1664a063db7e1bd53073f6f1c3a62fa0e55
SHA256cdaed7acb956972ce40a95412620150fcf1428c34a8ddbd0e9f0742df0d885bb
SHA512a8ba683aa3c9d607d7ef9c3ec28a924b23be85a90e5334eb2a9f6edb8117442a818608c44f010b2bdaec052319fcc6436b5628408f4ebb82d207196df1729e86
-
Filesize
8B
MD54b4a61d6d446a36ccde31e7ebd6e7aeb
SHA16abcca1983b34a570385eb5b421b92449c851dfc
SHA256d685543d9800644339454e98bc6c2f9ccea646fd51fdb5181583ca60fcdef8e9
SHA512c25ac03153db7beb8b163c82e5ef75e916346047a00202825b79797b6259f877eea6fac6ea333743d7e423d5fc65d713e9e0cafc0631321beab8ae01ede9ee65