56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
Size

26KB
MD5

47a4059e4e96f1dd6b4078106b7b532c
SHA1

db4eb7f4f961170dc3e892ccf7b2b70eac75f080
SHA256

56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8
SHA512

d25ccf6fbc53aa55c89bb5c0595cb42bbbf704375c2bb00135dbe34e01750b1bed1b08622858e54c44810558c08c86312e5c66d8a07002f0dac975a8d109d7d3
SSDEEP

768:E1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:OfgLdQAQfcfymN

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\J:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\G:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\E:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\X:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\Q:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\P:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\W:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\S:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\L:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\H:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\V:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\N:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\U:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\T:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\R:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\M:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\K:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\I:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\Z:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened (read-only)	\??\Y:	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2792	1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe	30
PID 1656 wrote to memory of 2792	1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe	30
PID 1656 wrote to memory of 2792	1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe	30
PID 1656 wrote to memory of 2792	1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe	30
PID 2792 wrote to memory of 2716	2792	net.exe	32
PID 2792 wrote to memory of 2716	2792	net.exe	32
PID 2792 wrote to memory of 2716	2792	net.exe	32
PID 2792 wrote to memory of 2716	2792	net.exe	32
PID 1656 wrote to memory of 1388	1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe	21
PID 1656 wrote to memory of 1388	1656	56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe
  "C:\Users\Admin\AppData\Local\Temp\56ec518403d910b51e476b1f7be3a9a7e5584a1fb05182aac47d8b0b3a0b2ed8.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
2ecf69524ee3f9f7aae90c6036b86efd

SHA1
b3e98562599476122baee62e5adac27cff633dfd

SHA256
e0d4b4b2c15fbed16b15627356787e333277599d764670bc2a3a7109230c7487

SHA512
7cf7a13a50b118b94bc7484ec2ccc9f16fcce4899c634aed949ff7576abb8ec28eae0cf1a48d0a7c3d9fb517ed90a12974377d40daac80a9106fea7fa7557d70

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
761a562e7eaf5c697d6b02969379b615

SHA1
5671a99b75af68778a8a36007eefd6e892972782

SHA256
8a461ba7f0e9b950957549584832198df686242c773365dda69954cd2956e227

SHA512
2725ce70eb7ec71002235178b6500605fe3931299e24f9f92918c2fae9315cdd4e6f2557c24ba0caa2da6ed4baaa87fcd33aae8b498f65f3cb4b015309f3d95b

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\_desktop.ini

Filesize
9B

MD5
cd0bf5c2efb8cc7ddbff2ab5d2cb7e87

SHA1
6830a1817f2055b6beba9063b87af16bbef7fa19

SHA256
d00701a279110fcafdaa6a9dcb36385845f9d2aac5b1ac1c52c015c61718dcbd

SHA512
6fabfd6bced63153d3dd6b376a92e824c95b15ef046607b89376a17c7ac863e92c95770ed86d8ecec3639d280dd6256a7ab1ec2d8119799fb3a479fbce96254a

Download Submit
memory/1388-5-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/1656-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-66-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-1850-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-3310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download