Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 02:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
General
-
Target
f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe
-
Size
369KB
-
MD5
fe14b8570ecb8f990a855db0e22c12c2
-
SHA1
1f5bbad878929849b08c27b181e85feca4030346
-
SHA256
f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55
-
SHA512
7c8c67b19898f181ad1c8e71e788c96964aa16465822956bc6c035211ff2468f346cbbf3c9bc7aa3e807decc46b205c976cf90580e34553b0efbaa7e6e40dfde
-
SSDEEP
6144:uB46tGdye41jzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:uB3NbVU66b5zhVymA/XSRh
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1528 Logo1_.exe 4996 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Services\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Licenses16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3364 wrote to memory of 3764 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 82 PID 3364 wrote to memory of 3764 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 82 PID 3364 wrote to memory of 3764 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 82 PID 3764 wrote to memory of 4148 3764 net.exe 84 PID 3764 wrote to memory of 4148 3764 net.exe 84 PID 3764 wrote to memory of 4148 3764 net.exe 84 PID 3364 wrote to memory of 3332 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 88 PID 3364 wrote to memory of 3332 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 88 PID 3364 wrote to memory of 3332 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 88 PID 3364 wrote to memory of 1528 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 90 PID 3364 wrote to memory of 1528 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 90 PID 3364 wrote to memory of 1528 3364 f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe 90 PID 1528 wrote to memory of 5052 1528 Logo1_.exe 91 PID 1528 wrote to memory of 5052 1528 Logo1_.exe 91 PID 1528 wrote to memory of 5052 1528 Logo1_.exe 91 PID 3332 wrote to memory of 4996 3332 cmd.exe 93 PID 3332 wrote to memory of 4996 3332 cmd.exe 93 PID 5052 wrote to memory of 2064 5052 net.exe 94 PID 5052 wrote to memory of 2064 5052 net.exe 94 PID 5052 wrote to memory of 2064 5052 net.exe 94 PID 1528 wrote to memory of 696 1528 Logo1_.exe 96 PID 1528 wrote to memory of 696 1528 Logo1_.exe 96 PID 1528 wrote to memory of 696 1528 Logo1_.exe 96 PID 696 wrote to memory of 2228 696 net.exe 98 PID 696 wrote to memory of 2228 696 net.exe 98 PID 696 wrote to memory of 2228 696 net.exe 98 PID 1528 wrote to memory of 3524 1528 Logo1_.exe 56 PID 1528 wrote to memory of 3524 1528 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe"C:\Users\Admin\AppData\Local\Temp\f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA410.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe"C:\Users\Admin\AppData\Local\Temp\f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe"4⤵
- Executes dropped EXE
PID:4996
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2064
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2228
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5ad49cc293adc3202b706d4f7127d628d
SHA14660eed68d5c97632885a8bd75890aca547cbee0
SHA2565591244c79a8e0e04bbc4e36e6bf4a55ec59b3d3f4b20d027a668c7f60125dcb
SHA512bf1923dfbcb6657d1c6a2a7d7043f51232ae7e148f02f15bc99f458b60c8a3080a1882c8232f598b259b953f8a8ef019d0fc9268af802e42de216645cd3ad1b0
-
Filesize
577KB
MD53ef47512091981bb9d1603c421a688d9
SHA172eba11625662084d535aa4fa2fc4bc86da61fd6
SHA256980fec6a47516939fa753290022964acb7a90e205d0ea14af1d94ca20b37c570
SHA512ac16134d4c065ed8770c8ded8c60a6a142c21fb52a1e7f05f4534a7ff1bae4e27380785231b954b1c6b7f5e91eed18bb81df340912368b264129a82bc76f89f2
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD574f614352141ac4f78c3e59955ed2258
SHA1179465d798ce029d20b16601530037ca9d87563f
SHA256e33cff13b2b5307aaa06fc8f6d15ebe31eeb5ac6ad8d12b4b5c877eb34cca70c
SHA512af736346b2a298b653dccc43a44d852001584bc22c5e00cb959246a0544044587e27ae3af6c253bf68b3dbe24a0badbe0bf55784f704d8e2f703afaed49ae6ae
-
Filesize
722B
MD5bcd085c51f8ac1f886ca0032e424acfc
SHA1ec0c5f2536b268809d68d4bc597e96c3d4b55e1d
SHA256a4253e3f0039f89cc7597dd2044c73b7a8f28331fdfb63852d08a0bd2b612783
SHA5120e176634f066d1dad12954b2486d1873c6ed4e84919331fea4365bf2305b3d68671f339af80e52292c4b1650b579d4d605a1d24b774428bf81b27a012d99d1fc
-
C:\Users\Admin\AppData\Local\Temp\f43f9585d1027b95044be41dc8a08ca70bd2c1e51fb82f812ba2a98e52763b55.exe.exe
Filesize335KB
MD540ac62c087648ccc2c58dae066d34c98
SHA10e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA256482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
SHA5120c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
-
Filesize
33KB
MD5bee6df131a9c9bccab2c2e85139f6842
SHA1d7d095b827384b3b5f4e0cf9b8afb543998f1796
SHA2561a8911fd47aa3e98991935402374717b26afeed5d8eb431edcd4625f1a16f962
SHA5122457aa406a3010ce789237d55fa17fc0f5694c847699af8044f21ea935179ffc69056c0c2ba4ba3eee3158c51afb2d11d2c372eca3e1ca77c44545cb74cd4812
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD5e2a14c19421b289cbd51a76363b166bd
SHA15d0621d68da5a444f49c090b0725c7044d47fdb7
SHA256844af243be560dc4e478aa7ea28f4959f9df45f204006bade7ae52398d651835
SHA5128c49bec05605c4d2b8f07f00a7a39e70f5bd4f7c84ba221c615447f947053bf3bb0496c38e2bf8b15235c493cc5a0b41f34285fed1adb4c13572f25b67e178e5