Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe
-
Size
264KB
-
MD5
bff283f236fd6be1b1135fc2c7f3d896
-
SHA1
60549c51c4a916b17dd383aee52a7da569a17fea
-
SHA256
ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd
-
SHA512
bae6758847fd539a1a65e2ee7b0482afb4aac405a1477b98e55f36d81fc746350ddc209d4f981e0a95a58a3fac7aecaffcf6d1e5f46d4c2917c5630c0311cfbc
-
SSDEEP
1536:KXe+Zk78UKUWlILFkbeumIkA39xSZW175V7UZQJ0UjsWpcdVO4Mqg+aJRaCAd1uq:KXe+auLRkgUA1nQZwFGVO4Mqg+WDY
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2044 Logo1_.exe 2464 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File created C:\Program Files\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe File created C:\Windows\Logo1_.exe ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe 2044 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4328 wrote to memory of 4672 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 83 PID 4328 wrote to memory of 4672 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 83 PID 4328 wrote to memory of 4672 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 83 PID 4672 wrote to memory of 1248 4672 net.exe 85 PID 4672 wrote to memory of 1248 4672 net.exe 85 PID 4672 wrote to memory of 1248 4672 net.exe 85 PID 4328 wrote to memory of 4872 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 89 PID 4328 wrote to memory of 4872 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 89 PID 4328 wrote to memory of 4872 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 89 PID 4328 wrote to memory of 2044 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 90 PID 4328 wrote to memory of 2044 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 90 PID 4328 wrote to memory of 2044 4328 ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe 90 PID 2044 wrote to memory of 4592 2044 Logo1_.exe 91 PID 2044 wrote to memory of 4592 2044 Logo1_.exe 91 PID 2044 wrote to memory of 4592 2044 Logo1_.exe 91 PID 4592 wrote to memory of 5024 4592 net.exe 94 PID 4592 wrote to memory of 5024 4592 net.exe 94 PID 4592 wrote to memory of 5024 4592 net.exe 94 PID 4872 wrote to memory of 2464 4872 cmd.exe 96 PID 4872 wrote to memory of 2464 4872 cmd.exe 96 PID 4872 wrote to memory of 2464 4872 cmd.exe 96 PID 2044 wrote to memory of 4352 2044 Logo1_.exe 97 PID 2044 wrote to memory of 4352 2044 Logo1_.exe 97 PID 2044 wrote to memory of 4352 2044 Logo1_.exe 97 PID 4352 wrote to memory of 2148 4352 net.exe 99 PID 4352 wrote to memory of 2148 4352 net.exe 99 PID 4352 wrote to memory of 2148 4352 net.exe 99 PID 2044 wrote to memory of 3404 2044 Logo1_.exe 55 PID 2044 wrote to memory of 3404 2044 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe"C:\Users\Admin\AppData\Local\Temp\ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a632E.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe"C:\Users\Admin\AppData\Local\Temp\ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2464
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5024
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2148
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD54dd56b31f3c4d0d5cfba349b906d5843
SHA1dde679248bf5eb0452051bac6853d62224d8cc27
SHA2562036eb95f6187dcbfd9e0a3bd443a589f150ef60cf8e831112214431d9c36311
SHA512779bc40fa720d7cc11f939efbd227e6ae5dd68224167bae1edb536f2c07019107ae367a541c4fb1beb52f99798b8bf4ec2a2018a44e8d5126cc648d252867f17
-
Filesize
577KB
MD50e4873e5fbd8b5bfa0969c62d188af8d
SHA1071e69887f14896be0479819d328344cacd3647e
SHA2566a35a88731ff34c53d3aa1c8100cfdd271d9c40d16e3f4873fb20b54cdb1bb89
SHA51212625fc1e03c2d01688050842175e5420ccbab5321ed72be2cb647f18fcbcc2048b5cefa2eaf41267fdc525c49f446f2a8c47f053cd95d8fb439079c22b534a4
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD529bab5fa7dbfd951e1c8290a8f4c2ba7
SHA17b86728d64cef9686bd45f2ff6fdc818c11a1bbb
SHA256dda333d8aed86ba750f669280e458ad2fb8d8ad5700a5fe0df584a1c818c481b
SHA5125bb37bffffe297653f91e0601f17b507659bcfe78567e6e1d10506d3c3bea737e7d6374224ecc01f421cff8f74b299eba8fe3152742b2b1c228966a630de1339
-
Filesize
722B
MD55902edaddaeb9d567cb9f9bfa7feea29
SHA1199682c9d93474e508362f82769626579915ab02
SHA256da4d479edc0846338bbf869706ba2b8260df51735eebb415ee4ac090927503ce
SHA5121ba73610da7e4d57d38d1f2e8a840688a26002fbee40e9c0f52068bff984ee5a6b9c4d4b0d50f10a6548ab51a29d09ae0bfa05d6e303f24b0b9052f043c0bc52
-
C:\Users\Admin\AppData\Local\Temp\ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd.exe.exe
Filesize231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
Filesize
33KB
MD59b3072c3c58526ecbf15d66e52c04941
SHA1500489a16879706004a62e507aee720aca23fdf3
SHA256eecc0652adacd259e61170088ceea9864602c9df8ec70d8a5668e66a69e00390
SHA5126a9799d8bdac1e7a29dfdaade10932f98009fc0cf3a56649ae893f41358ccb7a974e0b34346691e749a3e93447ce58ba29a5e96af5fca60ccf32afd8bfd9591d
-
Filesize
9B
MD59f88a7249d726e0d4ebea8ef2b661d98
SHA1f68a9700c917086c68acd41e85887dc8fcc4c2c3
SHA256969f39ddb9e19420959783eb412b391e2c49b99261750aa2716b781fabcc0f3b
SHA512f68c4e069aeefc665d8c92f0c734098e4de0f4b1bea40dd72510827a49f9bd2ef6dd5b606d05cb0716630f1f27f471c3cf7d036442f34c3faa4f905d6101e21f