Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe
-
Size
399KB
-
MD5
a13640e988030d6dc8fa839ad06f6662
-
SHA1
f7920aed4704a0f6d5b9b60c5c3b9e1b9208e8e9
-
SHA256
77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4
-
SHA512
5b51f9808387675eaa8c45162d53b709ecc00577ab4f2a198526df13479f434cf8a9856673d5c1a84a3d0b5e56f36afb39c751ac1a30b59c0a8163ee5e83aef8
-
SSDEEP
6144:V+azbRZvLP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYFk:V+azbvcahVy41
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4868 Logo1_.exe 2568 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe File created C:\Windows\Logo1_.exe 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe 4868 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1700 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 82 PID 1916 wrote to memory of 1700 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 82 PID 1916 wrote to memory of 1700 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 82 PID 1700 wrote to memory of 4720 1700 net.exe 84 PID 1700 wrote to memory of 4720 1700 net.exe 84 PID 1700 wrote to memory of 4720 1700 net.exe 84 PID 1916 wrote to memory of 2424 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 85 PID 1916 wrote to memory of 2424 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 85 PID 1916 wrote to memory of 2424 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 85 PID 1916 wrote to memory of 4868 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 86 PID 1916 wrote to memory of 4868 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 86 PID 1916 wrote to memory of 4868 1916 77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe 86 PID 4868 wrote to memory of 4812 4868 Logo1_.exe 87 PID 4868 wrote to memory of 4812 4868 Logo1_.exe 87 PID 4868 wrote to memory of 4812 4868 Logo1_.exe 87 PID 4812 wrote to memory of 4260 4812 net.exe 90 PID 4812 wrote to memory of 4260 4812 net.exe 90 PID 4812 wrote to memory of 4260 4812 net.exe 90 PID 2424 wrote to memory of 2568 2424 cmd.exe 91 PID 2424 wrote to memory of 2568 2424 cmd.exe 91 PID 4868 wrote to memory of 1080 4868 Logo1_.exe 92 PID 4868 wrote to memory of 1080 4868 Logo1_.exe 92 PID 4868 wrote to memory of 1080 4868 Logo1_.exe 92 PID 1080 wrote to memory of 2828 1080 net.exe 94 PID 1080 wrote to memory of 2828 1080 net.exe 94 PID 1080 wrote to memory of 2828 1080 net.exe 94 PID 4868 wrote to memory of 3424 4868 Logo1_.exe 56 PID 4868 wrote to memory of 3424 4868 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe"C:\Users\Admin\AppData\Local\Temp\77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8472.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe"C:\Users\Admin\AppData\Local\Temp\77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe"4⤵
- Executes dropped EXE
PID:2568
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4260
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
583KB
MD5947a60db2a42794d0901a22e4c7bfb56
SHA197bc341381e7b5880ae856fcc27ce1905d47b972
SHA256bb80ce796ee128b6672a646c23a765db4b068103431f40a06eea323545b56849
SHA512a5ed31c30bda0023156818d4c30b35083a7c0d82f14095ec525ae8e5fe9c1764e2dcc2cac60ffecaf5adace71243af40ba31785a822be002ba8ec194e4f2740b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD53e7cc0550b3e262224a01196dcffca48
SHA184b97784946a4f4edc8528690aee26cff4a5c35d
SHA256df205fe7ab5dd6c98547afe872f5b3bb66028f2cb14696fbc45610b0ef4723bf
SHA512864943da2a29d2e8aaca17a10ed791f22b3387c85fe19c19dea1ab3b89b3d6540dbd187f867742967a696ba0b76ce6e576a2825cc9147d77ab79f3a4f2a4ab6a
-
Filesize
722B
MD53cbeaf4b3acc3ecf6cb9b03090bcdea7
SHA1c4b9fd366e6e665393950313926822d0438ebf84
SHA256f7b22e70a7e9e641e0cdf958835799e88ddc7e83babb7e8e341108bf28970466
SHA51297d302bb9df4de887120d802bf40a56b2aada1fee127f752a73739d904ac7c009924167f1c4b6be0c93f9c9700ef38ef718c138e4fce020490f242cd2f00ba49
-
C:\Users\Admin\AppData\Local\Temp\77ce0c9f140d8022b67b116441b7855ebd37d2724cad85c0a800f7a9c8e2fbe4.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
39KB
MD5abb9a80df3006b0d301bdc994ed2c37f
SHA130946837d9bf8c65151ef22dd27416249087de89
SHA25600b8befe4eb2c186c359ff3d0ac5257c740d950037741e847eac917789e2a6e2
SHA512dc8aea8d76ed69814651d734492e4d1c0f1d9236d4098fa7dae2bf76070338e96e4e1e316bdc77be06109b203b2b1f340fb820660ab82e04b3d7375504d577f1
-
Filesize
9B
MD582fa69b12ac2df558c85e86426eb13eb
SHA1ad90b8756e3bebe04450f6950419c761844d7b7e
SHA256f7622a3740b818722e46a36b5aeb1c0ba6bec25bec811e3dcfe0b5ba1d728775
SHA5123c4da39d3b0d68ade3ff8ded69bf1e78a1ef88f7ed70c85572ae06e6be78155ffc2f557f577208e579191be2d8be2a1fa833b9ca74a35bb69cf9c32c23f4d99f