Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
General
-
Target
55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
-
Size
48KB
-
MD5
0afccdcba7062a0eac1442ab279b6684
-
SHA1
8df03692954e89f0614affae9fe6a636be62f6b8
-
SHA256
55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb
-
SHA512
9d3a8fd3dcca0343e41a6b7a75063f574e10ece47866cf8d286054c968ee1ca22856227fd5757ecf3a81a0933bdb01364b13327858252dda96cfe9aa1e2e087d
-
SSDEEP
768:2s6Hp+Vxr1x5cE9Fl5pz8w1rU9hFInlI1LqYJUukGdKETL4Ibq:2Rpsrz8GvnG1hXRTlq
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3988 Logo1_.exe 1688 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe File created C:\Windows\Logo1_.exe 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4368 wrote to memory of 1540 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 84 PID 4368 wrote to memory of 1540 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 84 PID 4368 wrote to memory of 1540 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 84 PID 1540 wrote to memory of 4620 1540 net.exe 86 PID 1540 wrote to memory of 4620 1540 net.exe 86 PID 1540 wrote to memory of 4620 1540 net.exe 86 PID 4368 wrote to memory of 3632 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 88 PID 4368 wrote to memory of 3632 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 88 PID 4368 wrote to memory of 3632 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 88 PID 4368 wrote to memory of 3988 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 90 PID 4368 wrote to memory of 3988 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 90 PID 4368 wrote to memory of 3988 4368 55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe 90 PID 3988 wrote to memory of 1832 3988 Logo1_.exe 91 PID 3988 wrote to memory of 1832 3988 Logo1_.exe 91 PID 3988 wrote to memory of 1832 3988 Logo1_.exe 91 PID 3632 wrote to memory of 1688 3632 cmd.exe 93 PID 3632 wrote to memory of 1688 3632 cmd.exe 93 PID 3632 wrote to memory of 1688 3632 cmd.exe 93 PID 1832 wrote to memory of 1124 1832 net.exe 94 PID 1832 wrote to memory of 1124 1832 net.exe 94 PID 1832 wrote to memory of 1124 1832 net.exe 94 PID 3988 wrote to memory of 1256 3988 Logo1_.exe 95 PID 3988 wrote to memory of 1256 3988 Logo1_.exe 95 PID 3988 wrote to memory of 1256 3988 Logo1_.exe 95 PID 1256 wrote to memory of 3324 1256 net.exe 97 PID 1256 wrote to memory of 3324 1256 net.exe 97 PID 1256 wrote to memory of 3324 1256 net.exe 97 PID 3988 wrote to memory of 3568 3988 Logo1_.exe 56 PID 3988 wrote to memory of 3568 3988 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe"C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe"C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe"4⤵
- Executes dropped EXE
PID:1688
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1124
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3324
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5b2d42d2acc3ae6aeae98d929b3fceffd
SHA19a56b274f4e073f8e9f5869fad424ed8953d841c
SHA2566813174f48fd25892a5fa28d0dd808df9ff007f751539d5f6f99e30cda0d96b5
SHA51257feee21c0493c7fda61517d7bb734596e0de791bbdf09fe85ccc43e532f1fe65a4a4514ce9de20a1394e9f238444e14568ffbcc8fcc434f88b5a7d956c39ea8
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD59044b8cb7dee805474f46fdff328cebb
SHA11cabc4c6c2c86cbb78765bc9dbc34fb343a473d2
SHA25662fedddac5d2bc0012582f6d5c8a62f1cfeb146338ded33892f3e2e9a3080618
SHA5124c3baf797abb9745bd194cb39da4f7541273d5ceb694929e562b3823118a8851a9b5dde4379d3936ca8fc233339560f7716518a62b421a2fcfe228d1037d9753
-
Filesize
721B
MD5bddfac4e58b97558412f95b1de13bd5a
SHA15a341f55815657428a8d395ea0eb80a0bb8acd03
SHA2563c2a21a91d58a914f1a0a51a780636f5fff193e285d29c1085245dbb546fd8d0
SHA5127c207de9c60b20d8508e7e52501c615e36774339e0621d0fc8c578dab6be79666506d464b95c65b69c13bc8856ba609487eff9e89e9086a0e8b28ae3577cf1c1
-
C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe.exe
Filesize14KB
MD5dc6311fbfd49f41fbf35860a30e68355
SHA1b08b15be412e843acaf7ad5e6df0ef1e8bdb465c
SHA256ffdf81680522029c2eb578a9f442fd9692900a5c782c711e35203fb2d25620ba
SHA5125e2938f5a8396154928a7d093db3843d73497cea4f49c0f1b77e3aac6e29d1db7f0ad4518587c336f0dfccb67ff33aac8e12afa70503504c5d8d46d12a86e453
-
Filesize
33KB
MD5356cac02b916fa68cdb143461cd998e9
SHA1888516965d3843e0a10864d6cc0480cc912cf0a8
SHA256c0e06a40330d72717d8c82fa7844df30dd8c6d99447e2e2372dc22a95120a92f
SHA5126daeea1394153fb814655ef67b6220182f8eb0fb995f189f455771412e484c6522a6965c13b6ff748060778b25397ecb8a627b2fea4dffcf526ade0aaec53965
-
Filesize
9B
MD5e2a14c19421b289cbd51a76363b166bd
SHA15d0621d68da5a444f49c090b0725c7044d47fdb7
SHA256844af243be560dc4e478aa7ea28f4959f9df45f204006bade7ae52398d651835
SHA5128c49bec05605c4d2b8f07f00a7a39e70f5bd4f7c84ba221c615447f947053bf3bb0496c38e2bf8b15235c493cc5a0b41f34285fed1adb4c13572f25b67e178e5