17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
Size

29KB
MD5

d284a21fe9a6739bbac331de3ee5024a
SHA1

d8dae7b29d57e68cba6fd563aa5d3c7f433d421f
SHA256

17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb
SHA512

c51ace5fb0803c0d88792a7c61c8fd3047af72a5e07d6b3f8bb252939dd27722a1675d9bd439192ad501225202ce4083642591f52d453f68b3bc09486afb1e1d
SSDEEP

384:sbb4trq1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRS/0z6B:4irq16GVRu1yK9fMnJG2V9dL

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\V:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\J:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\G:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\Y:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\X:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\T:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\P:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\N:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\L:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\H:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\Z:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\U:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\O:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\M:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\S:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\Q:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\I:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\E:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\R:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened (read-only)	\??\K:	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\Crashpad\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\Crashpad\attachments\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\beeps\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\Crashpad\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-BR\View3d\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 5016	228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe	83
PID 228 wrote to memory of 5016	228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe	83
PID 228 wrote to memory of 5016	228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe	83
PID 5016 wrote to memory of 1416	5016	net.exe	85
PID 5016 wrote to memory of 1416	5016	net.exe	85
PID 5016 wrote to memory of 1416	5016	net.exe	85
PID 228 wrote to memory of 3464	228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe	55
PID 228 wrote to memory of 3464	228	17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe
  "C:\Users\Admin\AppData\Local\Temp\17c423946eb6bc020c324cbdb9c8a8b545c5a44955ba9c7614c41b509c561bfb.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
247KB

MD5
59314863b82fc4d8c089355eaf2a4ba5

SHA1
abcc991af0baaa9013aa8d0a62001fe54ca9a3d1

SHA256
345fa3cc66298d78d29e3ac455702cc22f93a0d4649ad9d2b0d1390eda405cf1

SHA512
a4240883dc5b6b98e72833d6c3fdb6228fac74a78534207aaf918ce3eafd3fc48527667333a79c3daff99fb6208b9cb959a6622fe77c3609276d7fa801dfc4ca

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
173KB

MD5
cb3e5c658f8efbe5998f4946c07125a5

SHA1
9904701c2c0c3a89b1113e80fdab60e5f9235bd6

SHA256
951ad25acaaf917850590c4f8a7fd19a758d94142b0dc74acc61d6ee22ede63d

SHA512
4dd05aedb9ba663ccee5cb65f83d021b2742a3dc262e33dab2586185d910f7a0daf52abd9b5cc428a6fb2ab017e3185236b987f23e4b6a270e29b96da7f788f0

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
17597a6d51527228f8965ac7d71bcbb9

SHA1
052b817f9a3d3fbc5a8f1a40504960a9265866f0

SHA256
7a10ccbccbeaf81905c2dc7f89f67c5ec2e15e77bb6c6987a4bb06bccc802c88

SHA512
662d549d1b1f09d517e7b3b4c9659efc5915b6c1a3e9f7075a4a5ba5954c1ba54e6f187e97537f444e2d33e4d342d4872ed8dd6212094492bd990d091f438958

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\_desktop.ini

Filesize
9B

MD5
f74f4ac317419affe59fa4d389dd7e7c

SHA1
010f494382d5a64298702fe3732c9b96f438c653

SHA256
74fafb0f14fb17a8a4963d5f46fc50b3517e7aa13414ac5f42edfdf212a9bb01

SHA512
f82fea1632b97d2b6771f43a6941c84d7fbb86f4c4f69e9b4335aa0e166e2670f09d451da61b13cb16994b9294e99b1cfa27f2447579645b3886b7bd014cc00f

Download Submit
memory/228-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-405-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-1219-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-4770-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-5215-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download