Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
General
-
Target
ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe
-
Size
236KB
-
MD5
9e183f434e86a14d0ac93de0b9ffda4e
-
SHA1
b4d0aa1c69637ac43165c296af5f22f72a27c2e6
-
SHA256
ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc
-
SHA512
aad4b2cd1d6f3bf1f324933c92707c80e75cb390ae5b329e5053220544dec748f494721a933317ee5609ac4e7c9c5ca365d420ce86a51102efc5a5c99ca48302
-
SSDEEP
3072:Ise+aX3zvapVOqhtWAGYWOvTE4BwSfGuLG8NoqJEPyXK/aWbJSP5xV0BUj:A+aX3Laz4KUuS8oqJIgKGe
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1020 Logo1_.exe 2604 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\EBWebView\x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe File created C:\Windows\Logo1_.exe ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe 1020 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1560 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 90 PID 1780 wrote to memory of 1560 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 90 PID 1780 wrote to memory of 1560 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 90 PID 1560 wrote to memory of 5068 1560 net.exe 92 PID 1560 wrote to memory of 5068 1560 net.exe 92 PID 1560 wrote to memory of 5068 1560 net.exe 92 PID 1780 wrote to memory of 5004 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 96 PID 1780 wrote to memory of 5004 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 96 PID 1780 wrote to memory of 5004 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 96 PID 1780 wrote to memory of 1020 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 98 PID 1780 wrote to memory of 1020 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 98 PID 1780 wrote to memory of 1020 1780 ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe 98 PID 1020 wrote to memory of 4952 1020 Logo1_.exe 100 PID 1020 wrote to memory of 4952 1020 Logo1_.exe 100 PID 1020 wrote to memory of 4952 1020 Logo1_.exe 100 PID 5004 wrote to memory of 2604 5004 cmd.exe 99 PID 5004 wrote to memory of 2604 5004 cmd.exe 99 PID 5004 wrote to memory of 2604 5004 cmd.exe 99 PID 4952 wrote to memory of 1900 4952 net.exe 102 PID 4952 wrote to memory of 1900 4952 net.exe 102 PID 4952 wrote to memory of 1900 4952 net.exe 102 PID 1020 wrote to memory of 2944 1020 Logo1_.exe 104 PID 1020 wrote to memory of 2944 1020 Logo1_.exe 104 PID 1020 wrote to memory of 2944 1020 Logo1_.exe 104 PID 2944 wrote to memory of 5012 2944 net.exe 106 PID 2944 wrote to memory of 5012 2944 net.exe 106 PID 2944 wrote to memory of 5012 2944 net.exe 106 PID 1020 wrote to memory of 3428 1020 Logo1_.exe 54 PID 1020 wrote to memory of 3428 1020 Logo1_.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe"C:\Users\Admin\AppData\Local\Temp\ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3D0.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe"C:\Users\Admin\AppData\Local\Temp\ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2604
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1900
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5012
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1440,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:81⤵PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD571ba7af50c95582d5533b66cb35dd83a
SHA1e04b58f7ee8b0ca9ef148ec1e10d088047f867ab
SHA2561ea29a665f9812577876ba26bd78ba674c2db7f4595a40d75b1dd8cd822a936b
SHA512031a9dffc539f40f0fe328c92b5a1610411f60dab96929d5eeb32018bbc754940cfb844d55becf9647a038dbf6fa885aecf6dcab8604434ae7cab5396cc1df15
-
Filesize
577KB
MD55ac4056f9d0b3bd588671434ead1c17f
SHA19d3e0e6c41fe202d78ac7adc0c26c0a5d27b5d9c
SHA256ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411
SHA51212955c0c491b2f4b5343ba8d64ac9c08eaa77cb5b84929b36fd9efde7e241dd1553d3175fb39d1f4f9a9cb9e1242f501df3943788977fb06b0d30871ba5330d2
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5a5d877ddb05e13f657da9a470f10bd7c
SHA10e06863bb66b72b01d0120f89a176a13ffccc6cc
SHA2565fba16468f3e99ea99a8b3007a6d4a34ddcbedcf757c192f0eaf707297414777
SHA512aa28dca40bbc144f40dec11b83cbb4ed746f3f74c831318c2eea0d5d4108ed6452485f30ab7f697114e19b48d4b256580042a542ebd65dacacea5e5384f600ed
-
Filesize
722B
MD5594e352195d09b73c9330850ea38cf1b
SHA1edaadb2908fd2a0e2263d5ab59adc379c145b6a7
SHA2561da268dd97c8a6208a429b885daabe28806f8cb4a4f8f424160b2e0ea702e996
SHA512c6c7217e61406b400eaad3d5ba4f7436cd993fb8daeb8af6192859c86e25deb7f4c6905bf593a5a8ce36b95baa32f521df66ce8830e8114a84ecdf32aeffaf0b
-
C:\Users\Admin\AppData\Local\Temp\ff2b62f4edd08116ba995037c3e48870febe35155564c1b590182e2167d6dbfc.exe.exe
Filesize203KB
MD55f1ba3be7e873d24ef709bbca0d07f88
SHA17ea62d7d32a18b6904b36501fb4cad573c99ed36
SHA2569d4ebad94997f790d19e8d998c4ee749aa6f73e30fd5512a48a839cb28c75470
SHA51228f6b537ecfffa21041cc317437db1f3970484ebd45b335bd12f3f3f81c58926b4fb9ddcf5e210180cf57106722c21257ff4e95b23434ff5b685882661b6af4d
-
Filesize
33KB
MD5c4ec2631f0913b349423b6d2bd687a6b
SHA19b9ae1664a063db7e1bd53073f6f1c3a62fa0e55
SHA256cdaed7acb956972ce40a95412620150fcf1428c34a8ddbd0e9f0742df0d885bb
SHA512a8ba683aa3c9d607d7ef9c3ec28a924b23be85a90e5334eb2a9f6edb8117442a818608c44f010b2bdaec052319fcc6436b5628408f4ebb82d207196df1729e86
-
Filesize
8B
MD524cfb7e9169e3ecbcdf34395dff5aed0
SHA164061d8b0afd788fb3d2990e90e61f14010896dd
SHA256e11477f26e6139dabba6ad5dab927732c6a3785db78f82194ad7ae20323c6578
SHA512a315d4ab14f15f8df115e35134f0a1eff8018b0c35c5a0283928f2d3f3014215d683973b9aeba1bc74c49437cc929ea4e2fb847b4305da6d5abca235c750e299