Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
General
-
Target
becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe
-
Size
93KB
-
MD5
337ab18f65129291a90b6481f92b6eca
-
SHA1
8c45f4fdb763d4e147ce0fc16990ff0edd0068d9
-
SHA256
becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600
-
SHA512
12f7275994f133a86f8401804d8d0bb4f6a37939e5fa620ea8489956f8bb7d198ad961f3800e1edb78e6eeb8853c2767c7991412db593345469138c8b75d3377
-
SSDEEP
1536:2EaYzMXqtGNttyeiZnZLYm1byapmebn4ddJZeY86iLflLJYEIs67rxo:2EaY46tGNttyeQLYm1WLK4ddJMY86ip1
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1992 Logo1_.exe 2160 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe File created C:\Windows\Logo1_.exe becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe 1992 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1060 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 83 PID 1616 wrote to memory of 1060 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 83 PID 1616 wrote to memory of 1060 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 83 PID 1060 wrote to memory of 2628 1060 net.exe 85 PID 1060 wrote to memory of 2628 1060 net.exe 85 PID 1060 wrote to memory of 2628 1060 net.exe 85 PID 1616 wrote to memory of 2792 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 89 PID 1616 wrote to memory of 2792 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 89 PID 1616 wrote to memory of 2792 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 89 PID 1616 wrote to memory of 1992 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 91 PID 1616 wrote to memory of 1992 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 91 PID 1616 wrote to memory of 1992 1616 becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe 91 PID 1992 wrote to memory of 4784 1992 Logo1_.exe 92 PID 1992 wrote to memory of 4784 1992 Logo1_.exe 92 PID 1992 wrote to memory of 4784 1992 Logo1_.exe 92 PID 2792 wrote to memory of 2160 2792 cmd.exe 94 PID 2792 wrote to memory of 2160 2792 cmd.exe 94 PID 4784 wrote to memory of 5104 4784 net.exe 95 PID 4784 wrote to memory of 5104 4784 net.exe 95 PID 4784 wrote to memory of 5104 4784 net.exe 95 PID 1992 wrote to memory of 1356 1992 Logo1_.exe 97 PID 1992 wrote to memory of 1356 1992 Logo1_.exe 97 PID 1992 wrote to memory of 1356 1992 Logo1_.exe 97 PID 1356 wrote to memory of 1708 1356 net.exe 99 PID 1356 wrote to memory of 1708 1356 net.exe 99 PID 1356 wrote to memory of 1708 1356 net.exe 99 PID 1992 wrote to memory of 3424 1992 Logo1_.exe 56 PID 1992 wrote to memory of 3424 1992 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe"C:\Users\Admin\AppData\Local\Temp\becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8491.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe"C:\Users\Admin\AppData\Local\Temp\becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe"4⤵
- Executes dropped EXE
PID:2160
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5104
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD53c5f394397a74cbfa685b50b4425d210
SHA184c7dd4da821baa51235a7825571beb7da6f5295
SHA256a694b4a11ca32bb858b22d364b6c482aa218d17348139b3e3f0ca0bae0349285
SHA512604ea58673841a1ef291b94fffd5b967b8db82b8c165a23b10794ef1ca778dabacc3bb95383b420406ba4ede9de50f912d6cb13133f0a93bd42385967da6a83f
-
Filesize
577KB
MD5e873c59e12d3bd9dbce20674068bb734
SHA1e6d73449866f78a0c9a54d90c007e17758dd1590
SHA256f3992f9e7bd3ea12328f5532c19c51fd874c42f4cec436b1e5c68c073d02106a
SHA512f4c50292a9e59f19e17ee7936315dc4a0cd53fe742cc51ac2253d8bc1f5af4195401ca4ece02a10b51492ba7e83027a7b656b151536808999d332098a706c139
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5aa1f66c378cbdbcb7882e245c07b9def
SHA1e50b4c0b495f97317f96ae0c42ca452b504e3970
SHA2561aa4de231335138bca74aa29fdf52f58adbe09b68e8d717e6549a0ad400c6f8f
SHA5129894d2bae12941be81164f3d00f9d90b69b421f9dbbd4436937ef667783a70d70c640e3fd5e7855bcb9e9ece0e04d2866140692dadffc19a3de1e8bf661ed9ed
-
Filesize
722B
MD55d95fc8dbdca0c4d08beece945d279a9
SHA1b19d4a7f8176884e3b00ab5585880394827df9e2
SHA256ed0ae65658f3e50b75a12aae53f359e17f0dd375d36e93f74655b47cc4b940c3
SHA512ae2b437a23bba989861dfb42ba3ee7168b8878943b45960636b2c3a017ac06099ecb0b47619ae88386e14268fdee8cd7501fd3f216e791cdb99714ef81d80e82
-
C:\Users\Admin\AppData\Local\Temp\becba84a12ae2f8f53621818c18226094579a6041f6ac327bbbb656e552f5600.exe
Filesize59KB
MD5dfc18f7068913dde25742b856788d7ca
SHA1cbaa23f782c2ddcd7c9ff024fd0b096952a2b387
SHA256ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf
SHA512d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945
-
Filesize
33KB
MD51aeb31ee1d951ea2e78a19f5b23cd7e4
SHA13dd09718e9e4bcc2a03d11456815d56b4e2587c4
SHA256537daec8665ada5375e0c87619d5d0992bfe0e7d9c976702554e20ae857eb6f9
SHA51206cbed6a3557d9f57d0e2e4ace95ff43501dc8a83262db49ce6d4feba98026c5453432048ba3bb55a4c339479d34384c3081d0e2b27daa09a00be0226daed2a1
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD55d65d1288c9ecedfd5f28d17a01a30bc
SHA1e5bb89b8ad5c73516abf7e3baeaf1855154381dc
SHA2563501728ad227b52ce4d4f85ddd0e6d28dfa7acce977ae27f1e337be209825a5f
SHA5126177ce001dd535382c3bae5e8c3cfda85d8d8b76b68bce10fa8e5e1e748fd1512a531ffc93fef1316f2c27d93b5b4a5b60a6391f0e131ccc5cc0a65c2755868e