Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 06:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe
-
Size
176KB
-
MD5
73d3829bda7873aad89b3e12ffc97f9a
-
SHA1
064bf3c8014ab716ec387ff53e377a4947442604
-
SHA256
c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111
-
SHA512
155b6fefbd4c8caa59f551f266954941e21b9badf4f493d122ff96a7d937cfcb2cfeb8194890c95487f85ceeffd4bf31c1b313e409afee027ff5bca4b083ee13
-
SSDEEP
3072:Kfe+a1DfByOpGjAvb3eLG2FmDDSrDVTFooWZet3:1+appyOpGcj3UFmDDSrDVTSBQ3
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2848 Logo1_.exe 3212 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{DB6811AE-E3A5-4699-96E8-C8D624A435A7}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Crashpad\attachments\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe File created C:\Windows\Logo1_.exe c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe 2848 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1600 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 84 PID 3056 wrote to memory of 1600 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 84 PID 3056 wrote to memory of 1600 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 84 PID 1600 wrote to memory of 3576 1600 net.exe 86 PID 1600 wrote to memory of 3576 1600 net.exe 86 PID 1600 wrote to memory of 3576 1600 net.exe 86 PID 3056 wrote to memory of 2700 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 89 PID 3056 wrote to memory of 2700 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 89 PID 3056 wrote to memory of 2700 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 89 PID 3056 wrote to memory of 2848 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 91 PID 3056 wrote to memory of 2848 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 91 PID 3056 wrote to memory of 2848 3056 c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe 91 PID 2700 wrote to memory of 3212 2700 cmd.exe 92 PID 2700 wrote to memory of 3212 2700 cmd.exe 92 PID 2848 wrote to memory of 3220 2848 Logo1_.exe 93 PID 2848 wrote to memory of 3220 2848 Logo1_.exe 93 PID 2848 wrote to memory of 3220 2848 Logo1_.exe 93 PID 3220 wrote to memory of 4148 3220 net.exe 96 PID 3220 wrote to memory of 4148 3220 net.exe 96 PID 3220 wrote to memory of 4148 3220 net.exe 96 PID 2848 wrote to memory of 2476 2848 Logo1_.exe 97 PID 2848 wrote to memory of 2476 2848 Logo1_.exe 97 PID 2848 wrote to memory of 2476 2848 Logo1_.exe 97 PID 2476 wrote to memory of 2260 2476 net.exe 99 PID 2476 wrote to memory of 2260 2476 net.exe 99 PID 2476 wrote to memory of 2260 2476 net.exe 99 PID 2848 wrote to memory of 3464 2848 Logo1_.exe 55 PID 2848 wrote to memory of 3464 2848 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe"C:\Users\Admin\AppData\Local\Temp\c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9376.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe"C:\Users\Admin\AppData\Local\Temp\c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe"4⤵
- Executes dropped EXE
PID:3212
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4148
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2260
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD56bb9d7b6949c25cc2312bcd71b8e4f91
SHA196d199177506b8cc560fbc5bddca9473e9444bbb
SHA256c9b0a0f3da1d9d659f8f1e9fd23403be58b04a4e96c1ee5bab96b7fd84aee5d6
SHA5129eab4cff5138c8d1409e97cb80dd88a190c6984591a15a3c6bef094ecab16856deeee19daba78b34b3b1a27ebf70a487196f3c6d92e4e9645c036b8f4d42e92d
-
Filesize
577KB
MD5d482896e968579c40dc016709636b6d9
SHA19f22a694928296a8f9711eae826019d4673890ad
SHA256d716593b016a341c615c009724981d6960b83767c51abda0b7bb3e3ab2fd7483
SHA5126638bd31dafc77f748009a9834599259daf1eb19804af8837d3a5d6339caf1f04cf839dbc543ddb45ce9101d24325eea33766a7117466ff915779d49e56b5d08
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD529bab5fa7dbfd951e1c8290a8f4c2ba7
SHA17b86728d64cef9686bd45f2ff6fdc818c11a1bbb
SHA256dda333d8aed86ba750f669280e458ad2fb8d8ad5700a5fe0df584a1c818c481b
SHA5125bb37bffffe297653f91e0601f17b507659bcfe78567e6e1d10506d3c3bea737e7d6374224ecc01f421cff8f74b299eba8fe3152742b2b1c228966a630de1339
-
Filesize
722B
MD5d5c0ccdf3cb0e7a3e3efbcc69f7bacaa
SHA19348dec9f9de0bd8393f142f1685b97b22a1965a
SHA2568fb6cd7d1790a9c3b116f2b434702a3f7d7069aaa2f9ec3dbf96eca5dd3507ef
SHA51294c8dfdea61d1209fbe0d450cee6d3caf5f0e8e5a12b9e66ad45862a76242d918908bd3ad36a6dd9b786c6df9a6ee6cfdf250662c3668a051345f07c5feb1147
-
C:\Users\Admin\AppData\Local\Temp\c229f2008c8101c7f6490694af2c8eb538c6c2abea578d74d4a94d18243f6111.exe.exe
Filesize143KB
MD533b4c87f18b4c49114d7a8980241657a
SHA1254c67b915e45ad8584434a4af5e06ca730baa3b
SHA256587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662
SHA51242b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9
-
Filesize
33KB
MD5ac4d54500ddcf012f66bc5ba7530beb1
SHA1375bfcd1b95696f4b1c5f93dd5621e5c16fcda98
SHA256733b97920694040cf31888669d75229717b34c0e0fe892d10bb5421f0879fc09
SHA512076bddcb1a579a43ec3714f9396a2b3836bcb86d469c9df56b9bbc94aaf1330069c97c75081e5414faf2160b8904f357fa823c40273e64c8278059c760fa974a
-
Filesize
9B
MD59f88a7249d726e0d4ebea8ef2b661d98
SHA1f68a9700c917086c68acd41e85887dc8fcc4c2c3
SHA256969f39ddb9e19420959783eb412b391e2c49b99261750aa2716b781fabcc0f3b
SHA512f68c4e069aeefc665d8c92f0c734098e4de0f4b1bea40dd72510827a49f9bd2ef6dd5b606d05cb0716630f1f27f471c3cf7d036442f34c3faa4f905d6101e21f