Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 06:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe
-
Size
577KB
-
MD5
903f72ba91960ebc9060836a34641c87
-
SHA1
394e7de33a7e6d3cd158ab0cfaa5d2cd02e9aa22
-
SHA256
474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1
-
SHA512
d471910066e4c650130dcbcd60f126e16ce693d263cc9a305010952bb77746a5dfb807ad9d7ae8a99cf14419ed0c07cc70b66504e31376a6c56cf95d9d39e824
-
SSDEEP
6144:Tl+aYE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:Tl+aj7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1892 Logo1_.exe 3232 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Security\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\EBWebView\x86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe 1892 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3236 wrote to memory of 2368 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 89 PID 3236 wrote to memory of 2368 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 89 PID 3236 wrote to memory of 2368 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 89 PID 2368 wrote to memory of 1888 2368 net.exe 91 PID 2368 wrote to memory of 1888 2368 net.exe 91 PID 2368 wrote to memory of 1888 2368 net.exe 91 PID 3236 wrote to memory of 4744 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 92 PID 3236 wrote to memory of 4744 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 92 PID 3236 wrote to memory of 4744 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 92 PID 3236 wrote to memory of 1892 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 94 PID 3236 wrote to memory of 1892 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 94 PID 3236 wrote to memory of 1892 3236 474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe 94 PID 1892 wrote to memory of 1084 1892 Logo1_.exe 95 PID 1892 wrote to memory of 1084 1892 Logo1_.exe 95 PID 1892 wrote to memory of 1084 1892 Logo1_.exe 95 PID 1084 wrote to memory of 448 1084 net.exe 97 PID 1084 wrote to memory of 448 1084 net.exe 97 PID 1084 wrote to memory of 448 1084 net.exe 97 PID 4744 wrote to memory of 3232 4744 cmd.exe 98 PID 4744 wrote to memory of 3232 4744 cmd.exe 98 PID 1892 wrote to memory of 5108 1892 Logo1_.exe 101 PID 1892 wrote to memory of 5108 1892 Logo1_.exe 101 PID 1892 wrote to memory of 5108 1892 Logo1_.exe 101 PID 5108 wrote to memory of 4844 5108 net.exe 103 PID 5108 wrote to memory of 4844 5108 net.exe 103 PID 5108 wrote to memory of 4844 5108 net.exe 103 PID 1892 wrote to memory of 3532 1892 Logo1_.exe 56 PID 1892 wrote to memory of 3532 1892 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe"C:\Users\Admin\AppData\Local\Temp\474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4513.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe"C:\Users\Admin\AppData\Local\Temp\474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe"4⤵
- Executes dropped EXE
PID:3232
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:448
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4844
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:1632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5903f72ba91960ebc9060836a34641c87
SHA1394e7de33a7e6d3cd158ab0cfaa5d2cd02e9aa22
SHA256474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1
SHA512d471910066e4c650130dcbcd60f126e16ce693d263cc9a305010952bb77746a5dfb807ad9d7ae8a99cf14419ed0c07cc70b66504e31376a6c56cf95d9d39e824
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD529bab5fa7dbfd951e1c8290a8f4c2ba7
SHA17b86728d64cef9686bd45f2ff6fdc818c11a1bbb
SHA256dda333d8aed86ba750f669280e458ad2fb8d8ad5700a5fe0df584a1c818c481b
SHA5125bb37bffffe297653f91e0601f17b507659bcfe78567e6e1d10506d3c3bea737e7d6374224ecc01f421cff8f74b299eba8fe3152742b2b1c228966a630de1339
-
Filesize
722B
MD57f92a70972364a158b8be35da5c8feb5
SHA122eb02ef7b286099febda38552396ac087c2672e
SHA25640f2e2c098e95cc4b3ec90e12f95fd1d5c9c642edd9c0b1491e8eff5937daed1
SHA51223017cd4f6096edc6b203eb8ffa6eecf5760f378482df02cd9c9955fb8ee60938f7239ecd823edb4133cd9a0168eb0461ba16bd664c37d41e7951a224f318b74
-
C:\Users\Admin\AppData\Local\Temp\474b532c3ed7f27d2777ed92cdda2807c9e71a7200c277acced40ad3684161a1.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
33KB
MD59435f9e43a38ce0b6e31956f107865a8
SHA17a2705aac32f58f2e13722b48debb612700fe49b
SHA256cb8cf1e35c54163f3acf9184f97538d1129558b35e83cd5d1fab09428cae6cd9
SHA512b73e47c7f8390420ce3f62d820a81b70ac0715c2350cce8b8575373465fdb532de9b35e1052d398c133bce71b4d9cab693bf10dd2709cdaa3d5625ad62df2900
-
Filesize
9B
MD582fa69b12ac2df558c85e86426eb13eb
SHA1ad90b8756e3bebe04450f6950419c761844d7b7e
SHA256f7622a3740b818722e46a36b5aeb1c0ba6bec25bec811e3dcfe0b5ba1d728775
SHA5123c4da39d3b0d68ade3ff8ded69bf1e78a1ef88f7ed70c85572ae06e6be78155ffc2f557f577208e579191be2d8be2a1fa833b9ca74a35bb69cf9c32c23f4d99f