Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 12:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe
-
Size
562KB
-
MD5
71d804c8cf876e65e93d58c79177c313
-
SHA1
41f12a009ee03714125acf9ef810d00d0d663e57
-
SHA256
51ed0ccf2ee16871ab39c8631be12f3f077c5bd9b62eb4951b3695e238c2468e
-
SHA512
0f45ed09d3c57a28b6dd58d542fdc5ebce02a734125d2ed53f433135a338b2563d56054d4f00632367cc8aa710b51ee9fbb6756cbeb3f8db705d9145b3c2800f
-
SSDEEP
12288:I+aUc9iJafmm2VYK+UNo0RweQfoAxHv9sN4A4H9J618UtQ43iUa:IBgVm2VZQwy9E1Vf3M
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3516 Logo1_.exe 2196 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Crashpad\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe File created C:\Windows\Logo1_.exe Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe 3516 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1944 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 83 PID 4692 wrote to memory of 1944 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 83 PID 4692 wrote to memory of 1944 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 83 PID 1944 wrote to memory of 4828 1944 net.exe 85 PID 1944 wrote to memory of 4828 1944 net.exe 85 PID 1944 wrote to memory of 4828 1944 net.exe 85 PID 4692 wrote to memory of 5096 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 89 PID 4692 wrote to memory of 5096 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 89 PID 4692 wrote to memory of 5096 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 89 PID 4692 wrote to memory of 3516 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 90 PID 4692 wrote to memory of 3516 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 90 PID 4692 wrote to memory of 3516 4692 Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe 90 PID 3516 wrote to memory of 2100 3516 Logo1_.exe 92 PID 3516 wrote to memory of 2100 3516 Logo1_.exe 92 PID 3516 wrote to memory of 2100 3516 Logo1_.exe 92 PID 2100 wrote to memory of 1972 2100 net.exe 94 PID 2100 wrote to memory of 1972 2100 net.exe 94 PID 2100 wrote to memory of 1972 2100 net.exe 94 PID 5096 wrote to memory of 2196 5096 cmd.exe 95 PID 5096 wrote to memory of 2196 5096 cmd.exe 95 PID 5096 wrote to memory of 2196 5096 cmd.exe 95 PID 3516 wrote to memory of 3660 3516 Logo1_.exe 97 PID 3516 wrote to memory of 3660 3516 Logo1_.exe 97 PID 3516 wrote to memory of 3660 3516 Logo1_.exe 97 PID 3660 wrote to memory of 4604 3660 net.exe 99 PID 3660 wrote to memory of 4604 3660 net.exe 99 PID 3660 wrote to memory of 4604 3660 net.exe 99 PID 3516 wrote to memory of 3396 3516 Logo1_.exe 56 PID 3516 wrote to memory of 3396 3516 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe"C:\Users\Admin\AppData\Local\Temp\Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a952B.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe"C:\Users\Admin\AppData\Local\Temp\Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe"4⤵
- Executes dropped EXE
PID:2196
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1972
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4604
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD53395b30fcc0d6523ea46f137be48c8c9
SHA1df2094e08af0afba34a5e31342517ffd807bf3fe
SHA2563b0c9dbe5393654bacd3cb1f0a10b45da8c4116aabbe5fc540c37ea51c5677b8
SHA5122a96f84d9932c1f0291bd6311803e0d8353039536f86de8a1351c0820b447b4e87de5563a482a1f60ba63efff81609e35fb20b42c497fbc523d53760e795063b
-
Filesize
577KB
MD5bf7572c3ba3c8b5ac53b6d5f5b0908ba
SHA1e3086473496515e05f877f452b868f93d8d48b74
SHA256c14fdb68393fb3709b09f03577d012bc842c1b7f8387a837ae0deef83a4c5602
SHA5126d0798d00218301bb4e3fc425b996372f77fcea25e2cb20355a4928b564bfc17b8806eb0772458958bd3641391bf98edcd6c2da46e72e9fbb0012ecf1b728ef4
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD529bab5fa7dbfd951e1c8290a8f4c2ba7
SHA17b86728d64cef9686bd45f2ff6fdc818c11a1bbb
SHA256dda333d8aed86ba750f669280e458ad2fb8d8ad5700a5fe0df584a1c818c481b
SHA5125bb37bffffe297653f91e0601f17b507659bcfe78567e6e1d10506d3c3bea737e7d6374224ecc01f421cff8f74b299eba8fe3152742b2b1c228966a630de1339
-
Filesize
728B
MD50934c8c3a885d86973c1136bf7e53056
SHA1a527bd60144c8b0979ae7134479c23c6545d8dda
SHA25634a0a9bc5110bc0f0acd719eec562b18a6c773544ab3b80e6a40d008b4a09b90
SHA512275f87a5cec2bcfc85fc97473811f345ac7dbca1f93c2e6f64e5dd2b3c5caf1a112b275b479c159bd9dab562f5aec66146a706a92628e448f4e2531f4063a8e9
-
C:\Users\Admin\AppData\Local\Temp\Virus.Injector.ATA_virussign.com_71d804c8cf876e65e93d58c79177c313.exe.exe
Filesize529KB
MD5cca0c5482b8a6a275d9d49433f435dfa
SHA1a72ae8621386e13c34055f612ae7612b8a18a39e
SHA2566ea08bbcedf7cb51cfbe4896ef8c589a4568b1d5240265b1dcfda83dc8b55365
SHA512b88f5cdb4bc08429ca40d24cef490128d341e10615d1d93d084b3247c2b28573d177d878c1385d3941e16a8bcc8a9f6b7870c152f4a43d02e69c05defcc9196e
-
Filesize
33KB
MD58db8f01ff3888c1cf7faa0d7bee56fac
SHA12e67943b7b89ed681aad28d547f5fe105b8d6bbb
SHA256ec7ddca76eda53f8cd5276c1300d78e1ac0e29c6eb14d95f0e6342ad97acf100
SHA512e87cca7c2892bc440f2d9a7de9935395a17726df780e56feb861d3219a8586993bd7b95f610609c589ebc694469eb1213d5e39986a90b83a48f5475ed3da547a
-
Filesize
8B
MD524cfb7e9169e3ecbcdf34395dff5aed0
SHA164061d8b0afd788fb3d2990e90e61f14010896dd
SHA256e11477f26e6139dabba6ad5dab927732c6a3785db78f82194ad7ae20323c6578
SHA512a315d4ab14f15f8df115e35134f0a1eff8018b0c35c5a0283928f2d3f3014215d683973b9aeba1bc74c49437cc929ea4e2fb847b4305da6d5abca235c750e299