Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe
-
Size
264KB
-
MD5
c31ac8f84f6cab4e929a81f98b942085
-
SHA1
7a1410de4243ac6b8216a4a78bf062b5d69fb5d9
-
SHA256
da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f
-
SHA512
a261103e2cad90a075f0b8d4f3db08e42c4b157a34e815ce4b66ce2894e7bdcf1c3f1b6f4f9e0f0e38b773255ea3752a929d39c750b6af72fa5c37ad0ec24066
-
SSDEEP
1536:21psrz8GvnGxILFkbeumIkA39xSZW175V7UZQJ0UjsWpcdVO4Mqg+aJRaCAd1uhg:2G8a4LRkgUA1nQZwFGVO4Mqg+WDY
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2208 Logo1_.exe 3344 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe File created C:\Windows\Logo1_.exe da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe 2208 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2876 wrote to memory of 428 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 83 PID 2876 wrote to memory of 428 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 83 PID 2876 wrote to memory of 428 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 83 PID 428 wrote to memory of 5084 428 net.exe 86 PID 428 wrote to memory of 5084 428 net.exe 86 PID 428 wrote to memory of 5084 428 net.exe 86 PID 2876 wrote to memory of 3700 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 89 PID 2876 wrote to memory of 3700 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 89 PID 2876 wrote to memory of 3700 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 89 PID 2876 wrote to memory of 2208 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 90 PID 2876 wrote to memory of 2208 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 90 PID 2876 wrote to memory of 2208 2876 da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe 90 PID 2208 wrote to memory of 2028 2208 Logo1_.exe 92 PID 2208 wrote to memory of 2028 2208 Logo1_.exe 92 PID 2208 wrote to memory of 2028 2208 Logo1_.exe 92 PID 2028 wrote to memory of 1456 2028 net.exe 94 PID 2028 wrote to memory of 1456 2028 net.exe 94 PID 2028 wrote to memory of 1456 2028 net.exe 94 PID 3700 wrote to memory of 3344 3700 cmd.exe 95 PID 3700 wrote to memory of 3344 3700 cmd.exe 95 PID 3700 wrote to memory of 3344 3700 cmd.exe 95 PID 2208 wrote to memory of 1372 2208 Logo1_.exe 97 PID 2208 wrote to memory of 1372 2208 Logo1_.exe 97 PID 2208 wrote to memory of 1372 2208 Logo1_.exe 97 PID 1372 wrote to memory of 720 1372 net.exe 99 PID 1372 wrote to memory of 720 1372 net.exe 99 PID 1372 wrote to memory of 720 1372 net.exe 99 PID 2208 wrote to memory of 3536 2208 Logo1_.exe 56 PID 2208 wrote to memory of 3536 2208 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe"C:\Users\Admin\AppData\Local\Temp\da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a734B.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe"C:\Users\Admin\AppData\Local\Temp\da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3344
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1456
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:720
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5bf6ffc2246b6428e62463703d832220a
SHA153e4545e46d3fe524dde0cd53ceec23a235db70c
SHA25617830f495479ee5296082845eff7f682f0e49fb9abe90d7cec769e46b7c333d6
SHA5120a57720cf03e967e9705feee121792041cdb942c6aff90b63e0a7f3a8bfec8b2480ac830e614ad7be005923ce708dbb68e759da74c8403f497a56e5f11006e94
-
Filesize
577KB
MD523a9f717d433858505287510824bc655
SHA1f5bc262ffd9cdb17ca896dd9843e89e27092d15a
SHA256751538fec8e6931a8f8b7f260d0583787b8bba9c0c9df5b2cf7aaaa9cd4c9449
SHA512db493884468fb8b1107d45181bdafa0ae327b742d9ef5305dd68f9a7297a861716a03f56d6cdab549ef3100d1bae692059115dc0b99cc9acad3654ee66d5b29a
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD59044b8cb7dee805474f46fdff328cebb
SHA11cabc4c6c2c86cbb78765bc9dbc34fb343a473d2
SHA25662fedddac5d2bc0012582f6d5c8a62f1cfeb146338ded33892f3e2e9a3080618
SHA5124c3baf797abb9745bd194cb39da4f7541273d5ceb694929e562b3823118a8851a9b5dde4379d3936ca8fc233339560f7716518a62b421a2fcfe228d1037d9753
-
Filesize
722B
MD5352b56ccb4daa874d258c5ce28a53134
SHA136d29b9e1a43ef07e9fc877120cd7de0474caed9
SHA256e367f698ea8de3124e4ca6ce20ec87d1f438b913dbd25af9125a499d2b00df3f
SHA51235adcee51d8a19c04e3dcb16b6a8e79fdb539635def1885d8d3792e648942722f12f60a5d6a9d5f3a476534edf001c7e4d7a81d32356cd46d0c18d4bbc10afa3
-
C:\Users\Admin\AppData\Local\Temp\da277dbbb9a83da7d03b2abe2462ebf9ed606a64a7dc4ce3a425b7b939f9b17f.exe.exe
Filesize231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
Filesize
33KB
MD5775b5b764d666c3f5bbe02f1169bf91f
SHA1212e1d0ce212d41757d153b51c569a7451f3dea5
SHA25605d7bcc1d42cf80c469164afef0f3470b3745027ce78c77b972cde2b3da6b972
SHA51214d015b5fd7337eeaaa47392d38db74a0b8bdbe9efb58f10afea74ac54e140ad51026166dc290afd412de261c27d4c1c6f85050bd665ff072394811110d87b3a
-
Filesize
9B
MD5e2a14c19421b289cbd51a76363b166bd
SHA15d0621d68da5a444f49c090b0725c7044d47fdb7
SHA256844af243be560dc4e478aa7ea28f4959f9df45f204006bade7ae52398d651835
SHA5128c49bec05605c4d2b8f07f00a7a39e70f5bd4f7c84ba221c615447f947053bf3bb0496c38e2bf8b15235c493cc5a0b41f34285fed1adb4c13572f25b67e178e5