Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 10:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe
-
Size
717KB
-
MD5
a3e266623b3a04c853f776ee6ad96b46
-
SHA1
24a7422e95c21a8cd0cd7dc4e970e1f8ba0c758b
-
SHA256
0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b
-
SHA512
4061a01c3a47cb54b248a642f77fdec22b2652e4c91d5e0ebab92f3963fff5594ef251a3fecc8422de272dc07279e81b8c933e07dffd1af1794efd199502f360
-
SSDEEP
12288:q3NbGfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:q3NWLOS2opPIXV
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1888 Logo1_.exe 1424 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe File created C:\Windows\Logo1_.exe 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe 1888 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4904 wrote to memory of 2188 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 82 PID 4904 wrote to memory of 2188 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 82 PID 4904 wrote to memory of 2188 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 82 PID 2188 wrote to memory of 4168 2188 net.exe 84 PID 2188 wrote to memory of 4168 2188 net.exe 84 PID 2188 wrote to memory of 4168 2188 net.exe 84 PID 4904 wrote to memory of 4716 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 85 PID 4904 wrote to memory of 4716 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 85 PID 4904 wrote to memory of 4716 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 85 PID 4904 wrote to memory of 1888 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 86 PID 4904 wrote to memory of 1888 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 86 PID 4904 wrote to memory of 1888 4904 0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe 86 PID 1888 wrote to memory of 2904 1888 Logo1_.exe 88 PID 1888 wrote to memory of 2904 1888 Logo1_.exe 88 PID 1888 wrote to memory of 2904 1888 Logo1_.exe 88 PID 4716 wrote to memory of 1424 4716 cmd.exe 90 PID 4716 wrote to memory of 1424 4716 cmd.exe 90 PID 2904 wrote to memory of 3348 2904 net.exe 91 PID 2904 wrote to memory of 3348 2904 net.exe 91 PID 2904 wrote to memory of 3348 2904 net.exe 91 PID 1888 wrote to memory of 2360 1888 Logo1_.exe 92 PID 1888 wrote to memory of 2360 1888 Logo1_.exe 92 PID 1888 wrote to memory of 2360 1888 Logo1_.exe 92 PID 2360 wrote to memory of 2204 2360 net.exe 94 PID 2360 wrote to memory of 2204 2360 net.exe 94 PID 2360 wrote to memory of 2204 2360 net.exe 94 PID 1888 wrote to memory of 3460 1888 Logo1_.exe 56 PID 1888 wrote to memory of 3460 1888 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe"C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4168
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEAF.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe"C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe"4⤵
- Executes dropped EXE
PID:1424
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3348
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2204
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD534e4b1c3fbe0af431dbfa32a394d538b
SHA1f3244184975b4613fddee62e1df0befe5f1cb023
SHA256cec6257742a6cb48acd9e0c67e5f3dcf31ae37a5a10b21341e017ddf8dfd6bba
SHA512744ecda9422db65edef59ec38a98c757e38f058d5673ffa0d7cc4a1434fa402262f18a98884f33649c9bcae8e334d2453f337a49f6c24effce32b19e1b7e6200
-
Filesize
577KB
MD51d5981eb84e918e433f083dd445f3578
SHA1b3be9cf4be408f589dcff53a0df8ee5f8add3e15
SHA256be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe
SHA512de4d52a73053a693087b5d3e225a67bc9d5164df5fd641c54c7782974b63c2693d88e883c47ab07ba790322439aee1cc48339f22016050b6ac1da3c8f985860f
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD585f79b883012dd5dc037b06f462adac7
SHA1f12851feae4f0bcf48d0d462f45f2decbf94967a
SHA256b336dfcbf2ef97806dd0f82228a4a803a6bd3ca71c8388dc1da04dff8c359b34
SHA512e2abde81d4f1c7c8dd590b6a92b5035e7ec86bcd71b5509065a15912b633989baa8f1f610552098a77f1d43b7516e6042b190c446193ce26a2173ca17c6ca2f9
-
Filesize
722B
MD5b4879f8558e88cf789fe4401b728f2d5
SHA1defb954d3d5e93a8f524f3fd11110c72d85e2253
SHA25660fc1042e98d9e8dcbbfeacd2737c8b8ff5c52afd94036c367a30da4f8dfc675
SHA512002cd6cd25fb882fec2e30ebfc716bb505a1a83e22e69b72035c6d794bd191990c938884f5aaa96171bc7a4563872e91076a31f03e78362e109c7526b1e31387
-
C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe.exe
Filesize684KB
MD550f289df0c19484e970849aac4e6f977
SHA13dc77c8830836ab844975eb002149b66da2e10be
SHA256b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
SHA512877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
-
Filesize
33KB
MD56c2e4d9285e03d13ad3438424d7c0433
SHA1199aa50fc7e1e2cd42d28599027a07bc33c77012
SHA256ed075c4bc2193c36e740c272f806413273c0cd7ecfa182cf31d9f8e0a2e37cc6
SHA512e44c0dc38f8d8af74b121b1b70e7ed883e186178898e07af391858dd38340ad5915f8f079679073c8b1d60900d387764f38557e8bc1d02752fde02c596f4704c
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf