Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe
-
Size
672KB
-
MD5
7b08da8947df9057718484434a6a637c
-
SHA1
e80822f71ee884192a360d294b1ecdae341b67a2
-
SHA256
b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91
-
SHA512
735230e158f6bcaf6b86652a196708b946cc6c3e3674092b226e7ca2a44bc8e0772e0cc639e993a557ee25e88d7c3979cda5d9f6d5f39a6ef764f446eff0a0ef
-
SSDEEP
6144:V+azbRZvSC9LRU0ySj14WH+JPb7uL8zRMnJjNhAp7SO8zRMnJjNhAp7S8FRcdEKw:V+azbvnPFlTz
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3424 Logo1_.exe 3772 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\_desktop.ini Logo1_.exe File created C:\Program Files\Crashpad\attachments\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Install\{80279D00-E918-45B7-8FD9-5E902C3B5EF2}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe File created C:\Windows\Logo1_.exe b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe 3424 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2948 wrote to memory of 1284 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 82 PID 2948 wrote to memory of 1284 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 82 PID 2948 wrote to memory of 1284 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 82 PID 1284 wrote to memory of 4168 1284 net.exe 84 PID 1284 wrote to memory of 4168 1284 net.exe 84 PID 1284 wrote to memory of 4168 1284 net.exe 84 PID 2948 wrote to memory of 1616 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 85 PID 2948 wrote to memory of 1616 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 85 PID 2948 wrote to memory of 1616 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 85 PID 2948 wrote to memory of 3424 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 87 PID 2948 wrote to memory of 3424 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 87 PID 2948 wrote to memory of 3424 2948 b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe 87 PID 3424 wrote to memory of 3572 3424 Logo1_.exe 88 PID 3424 wrote to memory of 3572 3424 Logo1_.exe 88 PID 3424 wrote to memory of 3572 3424 Logo1_.exe 88 PID 1616 wrote to memory of 3772 1616 cmd.exe 90 PID 1616 wrote to memory of 3772 1616 cmd.exe 90 PID 3572 wrote to memory of 4148 3572 net.exe 91 PID 3572 wrote to memory of 4148 3572 net.exe 91 PID 3572 wrote to memory of 4148 3572 net.exe 91 PID 3424 wrote to memory of 1576 3424 Logo1_.exe 92 PID 3424 wrote to memory of 1576 3424 Logo1_.exe 92 PID 3424 wrote to memory of 1576 3424 Logo1_.exe 92 PID 1576 wrote to memory of 4984 1576 net.exe 94 PID 1576 wrote to memory of 4984 1576 net.exe 94 PID 1576 wrote to memory of 4984 1576 net.exe 94 PID 3424 wrote to memory of 2992 3424 Logo1_.exe 49 PID 3424 wrote to memory of 2992 3424 Logo1_.exe 49
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe"C:\Users\Admin\AppData\Local\Temp\b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4168
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8695.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe"C:\Users\Admin\AppData\Local\Temp\b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe"4⤵
- Executes dropped EXE
PID:3772
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4148
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4984
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
583KB
MD5947a60db2a42794d0901a22e4c7bfb56
SHA197bc341381e7b5880ae856fcc27ce1905d47b972
SHA256bb80ce796ee128b6672a646c23a765db4b068103431f40a06eea323545b56849
SHA512a5ed31c30bda0023156818d4c30b35083a7c0d82f14095ec525ae8e5fe9c1764e2dcc2cac60ffecaf5adace71243af40ba31785a822be002ba8ec194e4f2740b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD53e7cc0550b3e262224a01196dcffca48
SHA184b97784946a4f4edc8528690aee26cff4a5c35d
SHA256df205fe7ab5dd6c98547afe872f5b3bb66028f2cb14696fbc45610b0ef4723bf
SHA512864943da2a29d2e8aaca17a10ed791f22b3387c85fe19c19dea1ab3b89b3d6540dbd187f867742967a696ba0b76ce6e576a2825cc9147d77ab79f3a4f2a4ab6a
-
Filesize
722B
MD5942ffe4489ef823e6b8b314db2c4b4e2
SHA193aae63051b7a2dc239d3aa71f56eaec4ae44ad8
SHA2564dc191d9a176285807f43fc91ca706c0625a867408aefa86c0e870e42a1540ed
SHA512d8e3ce4c499fd6046d4aa19de76e047b22508dd1233046a289787c0d716367d3714c1920526b3c16484363fc6cf9244216924c94ccd3f633fb2de6468bd5c86d
-
C:\Users\Admin\AppData\Local\Temp\b95ff9cfd84e5e53cad29b1249f7fdb874e73257a0d628af7728200c4a54dd91.exe.exe
Filesize633KB
MD52e0d056ad62b6ef87a091003714fd512
SHA173150bddb5671c36413d9fbc94a668f132a2edc5
SHA256cb83f04591cc1d602e650dd5c12f4470cf21b04328477bd6a52081f37c04bd7c
SHA512b8e920f8b7547aec6f5771e3e6119b01157e5e36a92c67142b0d73ffe0d501d933581e1fc752e5bba9ce819e3897be9c146bebfc0018e91318b0c99d188a2580
-
Filesize
39KB
MD5abb9a80df3006b0d301bdc994ed2c37f
SHA130946837d9bf8c65151ef22dd27416249087de89
SHA25600b8befe4eb2c186c359ff3d0ac5257c740d950037741e847eac917789e2a6e2
SHA512dc8aea8d76ed69814651d734492e4d1c0f1d9236d4098fa7dae2bf76070338e96e4e1e316bdc77be06109b203b2b1f340fb820660ab82e04b3d7375504d577f1
-
Filesize
9B
MD582fa69b12ac2df558c85e86426eb13eb
SHA1ad90b8756e3bebe04450f6950419c761844d7b7e
SHA256f7622a3740b818722e46a36b5aeb1c0ba6bec25bec811e3dcfe0b5ba1d728775
SHA5123c4da39d3b0d68ade3ff8ded69bf1e78a1ef88f7ed70c85572ae06e6be78155ffc2f557f577208e579191be2d8be2a1fa833b9ca74a35bb69cf9c32c23f4d99f