Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe
-
Size
723KB
-
MD5
ef1d319518a6e8d27e0d8ed1ee0cd0f8
-
SHA1
e430328e360b542da7e9929090312bd99426a5fd
-
SHA256
f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7
-
SHA512
08ea7d62b9e1a34dc3a126272307cdc3bfd89d2110ebacc519ab7521c31481a6f5a45a423dc3f2e6c3dd4c6c4f91d868b8ac3e1a01dd5d994bd8093edc219a1f
-
SSDEEP
12288:V+azbvPfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:VBzb/LOS2opPIXV
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 336 Logo1_.exe 3648 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Portable Devices\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\Skins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe File created C:\Windows\Logo1_.exe f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe 336 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3620 wrote to memory of 4936 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 82 PID 3620 wrote to memory of 4936 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 82 PID 3620 wrote to memory of 4936 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 82 PID 4936 wrote to memory of 1376 4936 net.exe 84 PID 4936 wrote to memory of 1376 4936 net.exe 84 PID 4936 wrote to memory of 1376 4936 net.exe 84 PID 3620 wrote to memory of 3952 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 85 PID 3620 wrote to memory of 3952 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 85 PID 3620 wrote to memory of 3952 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 85 PID 3620 wrote to memory of 336 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 87 PID 3620 wrote to memory of 336 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 87 PID 3620 wrote to memory of 336 3620 f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe 87 PID 336 wrote to memory of 1748 336 Logo1_.exe 88 PID 336 wrote to memory of 1748 336 Logo1_.exe 88 PID 336 wrote to memory of 1748 336 Logo1_.exe 88 PID 1748 wrote to memory of 4264 1748 net.exe 90 PID 1748 wrote to memory of 4264 1748 net.exe 90 PID 1748 wrote to memory of 4264 1748 net.exe 90 PID 3952 wrote to memory of 3648 3952 cmd.exe 91 PID 3952 wrote to memory of 3648 3952 cmd.exe 91 PID 336 wrote to memory of 540 336 Logo1_.exe 92 PID 336 wrote to memory of 540 336 Logo1_.exe 92 PID 336 wrote to memory of 540 336 Logo1_.exe 92 PID 540 wrote to memory of 8 540 net.exe 94 PID 540 wrote to memory of 8 540 net.exe 94 PID 540 wrote to memory of 8 540 net.exe 94 PID 336 wrote to memory of 3448 336 Logo1_.exe 56 PID 336 wrote to memory of 3448 336 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe"C:\Users\Admin\AppData\Local\Temp\f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA018.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe"C:\Users\Admin\AppData\Local\Temp\f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe"4⤵
- Executes dropped EXE
PID:3648
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4264
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:8
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
583KB
MD5947a60db2a42794d0901a22e4c7bfb56
SHA197bc341381e7b5880ae856fcc27ce1905d47b972
SHA256bb80ce796ee128b6672a646c23a765db4b068103431f40a06eea323545b56849
SHA512a5ed31c30bda0023156818d4c30b35083a7c0d82f14095ec525ae8e5fe9c1764e2dcc2cac60ffecaf5adace71243af40ba31785a822be002ba8ec194e4f2740b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize649KB
MD53e7cc0550b3e262224a01196dcffca48
SHA184b97784946a4f4edc8528690aee26cff4a5c35d
SHA256df205fe7ab5dd6c98547afe872f5b3bb66028f2cb14696fbc45610b0ef4723bf
SHA512864943da2a29d2e8aaca17a10ed791f22b3387c85fe19c19dea1ab3b89b3d6540dbd187f867742967a696ba0b76ce6e576a2825cc9147d77ab79f3a4f2a4ab6a
-
Filesize
722B
MD5c6bfb52599bb89063b35ce8d68e4842c
SHA11333ba90cd8e4af5f7c718d76958d2a1a1a6fd0d
SHA256f735713eb256bd9c4d03229297e8a930be2728ee06de88567e3a667f06abf82f
SHA512dfca1a6a1881bf962a3597d52a7b4a52c6dbdfc0d695d38f667c5aa461e00a5af64f96cf4f8472b53764d95153d673ff2ec36e3a12a4787a897ae1fab6727f14
-
C:\Users\Admin\AppData\Local\Temp\f693a7e8a92bb7b24eb811b7dba24b2f8c02814a6f81f3ec4f278fc9089b33a7.exe.exe
Filesize684KB
MD550f289df0c19484e970849aac4e6f977
SHA13dc77c8830836ab844975eb002149b66da2e10be
SHA256b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
SHA512877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
-
Filesize
39KB
MD5abb9a80df3006b0d301bdc994ed2c37f
SHA130946837d9bf8c65151ef22dd27416249087de89
SHA25600b8befe4eb2c186c359ff3d0ac5257c740d950037741e847eac917789e2a6e2
SHA512dc8aea8d76ed69814651d734492e4d1c0f1d9236d4098fa7dae2bf76070338e96e4e1e316bdc77be06109b203b2b1f340fb820660ab82e04b3d7375504d577f1
-
Filesize
9B
MD582fa69b12ac2df558c85e86426eb13eb
SHA1ad90b8756e3bebe04450f6950419c761844d7b7e
SHA256f7622a3740b818722e46a36b5aeb1c0ba6bec25bec811e3dcfe0b5ba1d728775
SHA5123c4da39d3b0d68ade3ff8ded69bf1e78a1ef88f7ed70c85572ae06e6be78155ffc2f557f577208e579191be2d8be2a1fa833b9ca74a35bb69cf9c32c23f4d99f