Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe
-
Size
370KB
-
MD5
f41eca2de059fd987bc2506ab11e1e67
-
SHA1
90b521dc3df97ad74294d52768df7f24d421d19c
-
SHA256
21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63
-
SHA512
29f5e378ad5aa54121f4f9c806165f6b1994921a0628b79876725fb1533923ede05ea7f21eb4f580559dba94799313e069ec95d9419d717beef1bb027bbcfba8
-
SSDEEP
6144:y46tGdy2t4DREcMZ5vVCiiKrao9afJu3YYtWGaVoRiS6hxH5AgPaxA:y3N2+FuvVCiisao9Ii3aViKHye
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1176 Logo1_.exe 3592 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\MicrosoftEdgeUpdate.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini Logo1_.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\rundl132.exe 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe File created C:\Windows\Logo1_.exe 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe 1176 Logo1_.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3592 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 3592 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4428 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 92 PID 4252 wrote to memory of 4428 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 92 PID 4252 wrote to memory of 4428 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 92 PID 4428 wrote to memory of 3608 4428 net.exe 94 PID 4428 wrote to memory of 3608 4428 net.exe 94 PID 4428 wrote to memory of 3608 4428 net.exe 94 PID 4252 wrote to memory of 4544 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 98 PID 4252 wrote to memory of 4544 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 98 PID 4252 wrote to memory of 4544 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 98 PID 4252 wrote to memory of 1176 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 100 PID 4252 wrote to memory of 1176 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 100 PID 4252 wrote to memory of 1176 4252 21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe 100 PID 1176 wrote to memory of 2512 1176 Logo1_.exe 101 PID 1176 wrote to memory of 2512 1176 Logo1_.exe 101 PID 1176 wrote to memory of 2512 1176 Logo1_.exe 101 PID 4544 wrote to memory of 3592 4544 cmd.exe 103 PID 4544 wrote to memory of 3592 4544 cmd.exe 103 PID 4544 wrote to memory of 3592 4544 cmd.exe 103 PID 2512 wrote to memory of 2376 2512 net.exe 104 PID 2512 wrote to memory of 2376 2512 net.exe 104 PID 2512 wrote to memory of 2376 2512 net.exe 104 PID 1176 wrote to memory of 1800 1176 Logo1_.exe 109 PID 1176 wrote to memory of 1800 1176 Logo1_.exe 109 PID 1176 wrote to memory of 1800 1176 Logo1_.exe 109 PID 1800 wrote to memory of 4684 1800 net.exe 111 PID 1800 wrote to memory of 4684 1800 net.exe 111 PID 1800 wrote to memory of 4684 1800 net.exe 111 PID 1176 wrote to memory of 3420 1176 Logo1_.exe 56 PID 1176 wrote to memory of 3420 1176 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe"C:\Users\Admin\AppData\Local\Temp\21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F4F.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe"C:\Users\Admin\AppData\Local\Temp\21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2376
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4684
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4272,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:81⤵PID:3124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5f0ffb78b244367db6810ce9bf492504c
SHA1eb1315c358576d7da18e9155a305e4f1bfda994b
SHA2560a50841f7dec7062e2674b4521a52e4595b5e8640fec954854910d9291a7457f
SHA51297dd1d97fab2cc99e3cd27e72843f03d849bee6949f80143c36e49830523f984b987a6a649517aa997797f0920bac3964e3bb4352bfe617e38934b914ba0c5b5
-
Filesize
577KB
MD573fb79a7c3b943aac9c3b3422e4bde5e
SHA176d0179f9aa8fb0dd4522e8be985039015e47f84
SHA256cec42526e8122620d00aa459a6c0aed09b498d371f9609f0da3ffabb1bd7dc7b
SHA512441178f80a6169b582db533a452c4a6dd55a982979bb8ea717209815998d9aad97a779cd0803633ade2b7b141b91106415ea058e80a9199a65ccc694a490526b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5d050665e659c92141fd75967324abbb9
SHA1e46e74817f16de29105bd984629efff0a5a84489
SHA25600f98615c07f81f148d5e7aa5136684f31e39553182087e42dfbb3dca31879ad
SHA51291e101d08f3a68e8770b2ca1d7a41ab90b3563f05e4f1d1b59994a1c5aaeac9e3ff3eeda4bf178bd38ce706b1e5b306de2ba556bed4c754e82421bf20e047af1
-
Filesize
722B
MD567f4bfc09fbc42ee43176c84eac4ad6f
SHA15dd4ead5b1d97f88f71ca7f2e8184555bc9b099e
SHA256912d7eb62550f39cde914f3301382ddfeb0d7a49326d1ac979537ac3687569dd
SHA512e0a31973bc4d6c7104135e41b7e25916f4d7455911471f50b18de233f8c2a526739c80ae549e9be043f4b9a32171034ab1709ea2721353d65284a3f5c4fdf074
-
C:\Users\Admin\AppData\Local\Temp\21a501743218230bbea2df7d870e995bfab7e3f961a6acda96238925b026cf63.exe.exe
Filesize337KB
MD5383dcbf7e816408a7bcc0a2c41634356
SHA18179e5d4f88995a92110e4341be44335fa6636f6
SHA2561a4bd956c34459258c85ca9c81dc547d2ef3e276c1f5d07f93902b4a8c74586e
SHA5128b0b5015fc9100d58d73c1b331318f4568cf16529205b127c4ff473df95a8f0a52d5271cc4b66640630ed633449eccdf025166781b67834cc04d8ce23d79554a
-
Filesize
33KB
MD583e8fb4783b94b6aabff3203a25d1f0f
SHA1a1f3950c7cb0bebc182695a34081d8d238dc276d
SHA2561be4c5253dd76584a8eb966c6b6cd76cd452131660ee3d4ac7fad64d8241ac97
SHA51237042f5517a418527235aedc23f2bd08b4b6fe25bcc115799f5707b1cde7b7ad9b0389a5a37173a8be331b3b7d8608b809da008466de3f7a9d6f4e7809ba5a6d
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD55d65d1288c9ecedfd5f28d17a01a30bc
SHA1e5bb89b8ad5c73516abf7e3baeaf1855154381dc
SHA2563501728ad227b52ce4d4f85ddd0e6d28dfa7acce977ae27f1e337be209825a5f
SHA5126177ce001dd535382c3bae5e8c3cfda85d8d8b76b68bce10fa8e5e1e748fd1512a531ffc93fef1316f2c27d93b5b4a5b60a6391f0e131ccc5cc0a65c2755868e