558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
Size

39KB
MD5

c1c4393bd2098d79eefa6ac914668e70
SHA1

5f18df44f05b51013ec8334a23b8f036638245a1
SHA256

558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4
SHA512

596a0f6d205d3cfdec032ec9dfbd3f660debf0917ee65c5d19f9f0e6e68e82e354730c0992b177b00419f516ae762568fff873e5e4b32ce4c91b17ff07933f76
SSDEEP

768:8RO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:8Re+Zk7VJbwlYXjPrsqrZMYR5p8w

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\Y:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\L:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\G:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\X:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\W:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\T:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\R:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\H:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\M:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\J:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\V:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\S:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\Q:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\P:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\O:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\N:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\E:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\U:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\K:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened (read-only)	\??\I:	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Internet Explorer\de-DE\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Microsoft Games\Hearts\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\ja-JP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\_desktop.ini	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
File created	C:\Windows\Dll.dll	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2360	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	31
PID 3032 wrote to memory of 2360	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	31
PID 3032 wrote to memory of 2360	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	31
PID 3032 wrote to memory of 2360	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	31
PID 2360 wrote to memory of 2288	2360	net.exe	33
PID 2360 wrote to memory of 2288	2360	net.exe	33
PID 2360 wrote to memory of 2288	2360	net.exe	33
PID 2360 wrote to memory of 2288	2360	net.exe	33
PID 3032 wrote to memory of 1884	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	34
PID 3032 wrote to memory of 1884	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	34
PID 3032 wrote to memory of 1884	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	34
PID 3032 wrote to memory of 1884	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	34
PID 1884 wrote to memory of 352	1884	net.exe	36
PID 1884 wrote to memory of 352	1884	net.exe	36
PID 1884 wrote to memory of 352	1884	net.exe	36
PID 1884 wrote to memory of 352	1884	net.exe	36
PID 3032 wrote to memory of 1184	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	21
PID 3032 wrote to memory of 1184	3032	558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe
  "C:\Users\Admin\AppData\Local\Temp\558c26ce0acd42db3a916cb557de680fd6f7733e9355b5daf950fe3b1dd53be4.exe"
  2⤵
  - Drops startup file
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7zFM.exe

Filesize
970KB

MD5
bc105cdfcb81389359eaadf3d8c6af82

SHA1
5069aff5719da008c610414fd4e537f7decb473c

SHA256
afaa71563979a6684f2c5fc87c6c3e2856ccfb6e1c883e88ebb2b14440b508e6

SHA512
bf365283ecea2bc8ea121725aabcb0767c34b6b8fe60cf325ac55634b1b922d97595f22bd6d1e1ba7492d2e1a9563b76eaac12077ab9e81c8bba8a64dfbc1011

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
484KB

MD5
a803cec17e97a23f06f00bad17aa1236

SHA1
7a5c9795e740bbf318d745de0eb80adb7d74538d

SHA256
2846d29686b5eef885188d8c5dc0ff71e19a25d497490f99f99e837959a7b7ff

SHA512
ca0b62858ee4af691cd9dfa6c9325d4dbe1e2dd232c8f30e24156dc9560211666724e41e305467475760b80bdbed429887e2032191147c60504fb04e512ca620

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\_desktop.ini

Filesize
9B

MD5
82fa69b12ac2df558c85e86426eb13eb

SHA1
ad90b8756e3bebe04450f6950419c761844d7b7e

SHA256
f7622a3740b818722e46a36b5aeb1c0ba6bec25bec811e3dcfe0b5ba1d728775

SHA512
3c4da39d3b0d68ade3ff8ded69bf1e78a1ef88f7ed70c85572ae06e6be78155ffc2f557f577208e579191be2d8be2a1fa833b9ca74a35bb69cf9c32c23f4d99f

Download Submit
memory/1184-3-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3032-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3032-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3032-2977-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3032-4170-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download