Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe
-
Size
5.7MB
-
MD5
4d713dadb00f207ac0750691e140d5df
-
SHA1
b6edbb2627a450c69782025cfbe7b4bddf06680e
-
SHA256
f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0
-
SHA512
3fb9ab66efd24045c4a6980788aa36881bec0919e88198ecf4c6987a7ca2b49f900ca2bb0daa5f901ac011e1e1b377f00e98b7f5d6b51ff439600f43ff769587
-
SSDEEP
49152:VBzVPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dr:V/KUgTH2M2m9UMpu1QfLczqssnKSk
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 5048 Logo1_.exe 2108 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe File created C:\Windows\Logo1_.exe f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe 5048 Logo1_.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4848 wrote to memory of 3124 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 85 PID 4848 wrote to memory of 3124 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 85 PID 4848 wrote to memory of 3124 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 85 PID 3124 wrote to memory of 3616 3124 net.exe 87 PID 3124 wrote to memory of 3616 3124 net.exe 87 PID 3124 wrote to memory of 3616 3124 net.exe 87 PID 4848 wrote to memory of 4916 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 88 PID 4848 wrote to memory of 4916 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 88 PID 4848 wrote to memory of 4916 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 88 PID 4848 wrote to memory of 5048 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 90 PID 4848 wrote to memory of 5048 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 90 PID 4848 wrote to memory of 5048 4848 f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe 90 PID 5048 wrote to memory of 4576 5048 Logo1_.exe 91 PID 5048 wrote to memory of 4576 5048 Logo1_.exe 91 PID 5048 wrote to memory of 4576 5048 Logo1_.exe 91 PID 4576 wrote to memory of 4520 4576 net.exe 94 PID 4576 wrote to memory of 4520 4576 net.exe 94 PID 4576 wrote to memory of 4520 4576 net.exe 94 PID 5048 wrote to memory of 4248 5048 Logo1_.exe 95 PID 5048 wrote to memory of 4248 5048 Logo1_.exe 95 PID 5048 wrote to memory of 4248 5048 Logo1_.exe 95 PID 4248 wrote to memory of 876 4248 net.exe 97 PID 4248 wrote to memory of 876 4248 net.exe 97 PID 4248 wrote to memory of 876 4248 net.exe 97 PID 5048 wrote to memory of 3444 5048 Logo1_.exe 56 PID 5048 wrote to memory of 3444 5048 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe"C:\Users\Admin\AppData\Local\Temp\f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD590.bat3⤵
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe"C:\Users\Admin\AppData\Local\Temp\f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe"4⤵
- Executes dropped EXE
PID:2108
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4520
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:876
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
583KB
MD5947a60db2a42794d0901a22e4c7bfb56
SHA197bc341381e7b5880ae856fcc27ce1905d47b972
SHA256bb80ce796ee128b6672a646c23a765db4b068103431f40a06eea323545b56849
SHA512a5ed31c30bda0023156818d4c30b35083a7c0d82f14095ec525ae8e5fe9c1764e2dcc2cac60ffecaf5adace71243af40ba31785a822be002ba8ec194e4f2740b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD53e7cc0550b3e262224a01196dcffca48
SHA184b97784946a4f4edc8528690aee26cff4a5c35d
SHA256df205fe7ab5dd6c98547afe872f5b3bb66028f2cb14696fbc45610b0ef4723bf
SHA512864943da2a29d2e8aaca17a10ed791f22b3387c85fe19c19dea1ab3b89b3d6540dbd187f867742967a696ba0b76ce6e576a2825cc9147d77ab79f3a4f2a4ab6a
-
Filesize
722B
MD5ab6b03c04c1867adeb5f51b108bdae64
SHA1ad120a9daecc5e67ed6b383c88b14f9e61bc4c0c
SHA256bd335d09b8b7ddedf58da44ed488b006e854f8c9e28fa35d5aed418cc29e1361
SHA5127986443c532af0bfe4b4a3806c11ad22d950f4a4300dee25c7ed9a164555efbebf6bd32e7cdc4a453b0b51bf0baf5fcb266d7c10becae8119ecd2454568a63ad
-
C:\Users\Admin\AppData\Local\Temp\f39fbb2293ecd37bbc772f10f1253e6242ac63b6cf6dcd66a7a05ce74ef8f9d0.exe.exe
Filesize5.7MB
MD5ba18e99b3e17adb5b029eaebc457dd89
SHA1ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA256f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
SHA5121f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
-
Filesize
39KB
MD5abb9a80df3006b0d301bdc994ed2c37f
SHA130946837d9bf8c65151ef22dd27416249087de89
SHA25600b8befe4eb2c186c359ff3d0ac5257c740d950037741e847eac917789e2a6e2
SHA512dc8aea8d76ed69814651d734492e4d1c0f1d9236d4098fa7dae2bf76070338e96e4e1e316bdc77be06109b203b2b1f340fb820660ab82e04b3d7375504d577f1
-
Filesize
9B
MD582fa69b12ac2df558c85e86426eb13eb
SHA1ad90b8756e3bebe04450f6950419c761844d7b7e
SHA256f7622a3740b818722e46a36b5aeb1c0ba6bec25bec811e3dcfe0b5ba1d728775
SHA5123c4da39d3b0d68ade3ff8ded69bf1e78a1ef88f7ed70c85572ae06e6be78155ffc2f557f577208e579191be2d8be2a1fa833b9ca74a35bb69cf9c32c23f4d99f