Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 07:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe
-
Size
72KB
-
MD5
096085650918102b001b3f9bb6b2078a
-
SHA1
2c3fc6d2cb302d86efa375794e5264dcd2c7c31e
-
SHA256
c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503
-
SHA512
749f67c236a863fe8c1e177bbc6b57c9fcdbb43603a6162697d4161420eca575f7f5e786196e33af0529401711e57b8f2a96c4bf94c0793b7a7548a1bd3df356
-
SSDEEP
1536:Ate+Zk7qzUJBC2KsgSMcJziyDfzHa/iSfRmq:Ate+aezUa6pBiyDfzhSfRb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4584 Logo1_.exe 1396 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\images\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe File created C:\Windows\Logo1_.exe c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe 4584 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 264 wrote to memory of 3256 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 83 PID 264 wrote to memory of 3256 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 83 PID 264 wrote to memory of 3256 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 83 PID 3256 wrote to memory of 1644 3256 net.exe 85 PID 3256 wrote to memory of 1644 3256 net.exe 85 PID 3256 wrote to memory of 1644 3256 net.exe 85 PID 264 wrote to memory of 1172 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 89 PID 264 wrote to memory of 1172 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 89 PID 264 wrote to memory of 1172 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 89 PID 264 wrote to memory of 4584 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 90 PID 264 wrote to memory of 4584 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 90 PID 264 wrote to memory of 4584 264 c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe 90 PID 4584 wrote to memory of 4192 4584 Logo1_.exe 92 PID 4584 wrote to memory of 4192 4584 Logo1_.exe 92 PID 4584 wrote to memory of 4192 4584 Logo1_.exe 92 PID 1172 wrote to memory of 1396 1172 cmd.exe 94 PID 1172 wrote to memory of 1396 1172 cmd.exe 94 PID 1172 wrote to memory of 1396 1172 cmd.exe 94 PID 4192 wrote to memory of 5004 4192 net.exe 95 PID 4192 wrote to memory of 5004 4192 net.exe 95 PID 4192 wrote to memory of 5004 4192 net.exe 95 PID 4584 wrote to memory of 4616 4584 Logo1_.exe 99 PID 4584 wrote to memory of 4616 4584 Logo1_.exe 99 PID 4584 wrote to memory of 4616 4584 Logo1_.exe 99 PID 4616 wrote to memory of 3988 4616 net.exe 101 PID 4616 wrote to memory of 3988 4616 net.exe 101 PID 4616 wrote to memory of 3988 4616 net.exe 101 PID 4584 wrote to memory of 3464 4584 Logo1_.exe 55 PID 4584 wrote to memory of 3464 4584 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe"C:\Users\Admin\AppData\Local\Temp\c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B2D.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe"C:\Users\Admin\AppData\Local\Temp\c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe"4⤵
- Executes dropped EXE
PID:1396
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5004
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD5bec822bf2d0062d8c7135bdd5198db70
SHA19683bff90a158ce766f8661f76905d03327073a8
SHA256b7c35b00d9d1dc323e12c11dc62443e390f6270c73e7e87038ad350198e82393
SHA5121b86a8b9dee288afb8d4adef795002c325a2b19de773cc7cadb407c717f87c57a06584b2f92a7e65107894b5935020d8da6a8005e660c22e2fcfdd06df93951c
-
Filesize
583KB
MD5e139d66c672489955f5bd474c5884240
SHA11b4360ad8cebf443f1f39ea0b9353d8b97c86b42
SHA256ee2997942af8ea07ed5ecd8f41fb1c01ffa739a2c5247a27605b527b472d2caf
SHA5128755334f20c130b93e1b9d566395125b6dbca54bbd7fae1478a04a6a3bb56852c0c69dd382b2cba7a015500ff4d1ed168ddc0cedc5da424c51acd333f7eac999
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD563b3bb79a49b72fddcd6d52791b91870
SHA112cc9c08a41e388dcfb041ba0333bb43e18e02eb
SHA25670f1aa895f442cbacfc8c168bb2f71cbc7b07529833e71d67114d9f3870304b3
SHA5124fbbe71ec709d911ddc46be49cc01217e0111f3f7b7f05b260ddc4d1f82f71b13275e3941592949bc70a4ca71b1b3af5c99d410e2cd87eecb93183302e59a893
-
Filesize
722B
MD517db2bc8c56c3431169351eb9f7849c9
SHA1360627c6c43ded8fd9c18fc8babbdadd1f6881e0
SHA25657d29182b73a66a69683e6494c88240d8896c020ff1624b5db8c8a76c2e8927f
SHA512fe9278dbdd0d86c65b6e5238cec20944f1b340787c59c28844824b3924ff81cfef9827ab36563f6b9c6720adf594198b19846e42ac1c3d702f26908e1f8b35b5
-
C:\Users\Admin\AppData\Local\Temp\c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503.exe.exe
Filesize33KB
MD5aa8eced8b0c3b3722e8958b79a4c6296
SHA14ff7ef88e26a40675f194b7f07e1bf8f3350ba07
SHA25691e0b1b49ace92844e5a9afffcf2fb584cfec9f548e58ef57e3dd37dfd19f638
SHA5126f2f104befbeefa821b86d47ec256f7b13ae8f00a7cbd5d724a7bdfd20c94c5cb53c654b5637b3c7ae4fc3cd2f10d6332bf08d85af718201068a985214322698
-
Filesize
39KB
MD50b034525c0a86d564a1585fe1b22bb5f
SHA1e12b56f99a607fb621f7af46c5d829d71ce97cd6
SHA256d8a7abd2d5a1dce1488ea5a68f80cdebca7225ab725853a8f5277855bdf23c4e
SHA5124ccf381fcb4038259db3a9e6099e79b203e4f8e22771300f9429d811ae022327953f2648458bfa78dac78e58b2cf2af8a1dad34207d736ebf4cfff0dedabbf4a
-
Filesize
8B
MD524cfb7e9169e3ecbcdf34395dff5aed0
SHA164061d8b0afd788fb3d2990e90e61f14010896dd
SHA256e11477f26e6139dabba6ad5dab927732c6a3785db78f82194ad7ae20323c6578
SHA512a315d4ab14f15f8df115e35134f0a1eff8018b0c35c5a0283928f2d3f3014215d683973b9aeba1bc74c49437cc929ea4e2fb847b4305da6d5abca235c750e299