Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 13:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe
-
Size
397KB
-
MD5
d949734f20f79ec417d3e7fb6449d02e
-
SHA1
e14a4a9a431a9be9108e85e0c25b0a271e806a97
-
SHA256
c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb
-
SHA512
bcd836a9b8e4fadc1c4078e23028fb19bba49e0afec2f63f8054565a14fb917dfa22e6d2b07eea906ec1381f1831411c76157fec934f9d591031b19382c2bb05
-
SSDEEP
6144:x+arnDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:x+arDXYJmSTZwYp32bY4qtDF
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4128 Logo1_.exe 4484 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe File created C:\Windows\Logo1_.exe c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe 4128 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1412 wrote to memory of 4436 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 82 PID 1412 wrote to memory of 4436 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 82 PID 1412 wrote to memory of 4436 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 82 PID 4436 wrote to memory of 3780 4436 net.exe 84 PID 4436 wrote to memory of 3780 4436 net.exe 84 PID 4436 wrote to memory of 3780 4436 net.exe 84 PID 1412 wrote to memory of 1108 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 85 PID 1412 wrote to memory of 1108 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 85 PID 1412 wrote to memory of 1108 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 85 PID 1412 wrote to memory of 4128 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 87 PID 1412 wrote to memory of 4128 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 87 PID 1412 wrote to memory of 4128 1412 c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe 87 PID 4128 wrote to memory of 4060 4128 Logo1_.exe 88 PID 4128 wrote to memory of 4060 4128 Logo1_.exe 88 PID 4128 wrote to memory of 4060 4128 Logo1_.exe 88 PID 4060 wrote to memory of 2856 4060 net.exe 90 PID 4060 wrote to memory of 2856 4060 net.exe 90 PID 4060 wrote to memory of 2856 4060 net.exe 90 PID 1108 wrote to memory of 4484 1108 cmd.exe 91 PID 1108 wrote to memory of 4484 1108 cmd.exe 91 PID 4128 wrote to memory of 2616 4128 Logo1_.exe 92 PID 4128 wrote to memory of 2616 4128 Logo1_.exe 92 PID 4128 wrote to memory of 2616 4128 Logo1_.exe 92 PID 2616 wrote to memory of 2368 2616 net.exe 94 PID 2616 wrote to memory of 2368 2616 net.exe 94 PID 2616 wrote to memory of 2368 2616 net.exe 94 PID 4128 wrote to memory of 3416 4128 Logo1_.exe 56 PID 4128 wrote to memory of 3416 4128 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe"C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68AD.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe"C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe"4⤵
- Executes dropped EXE
PID:4484
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2856
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2368
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD5ddd0ad3db7482769dc0fe736a9dd9b05
SHA1e9f7c66131b006d5f2c88453286df51545a8297a
SHA25648fce946ddc616d1c989e4fb2bfa281953e541c040022bc1567412ebae492145
SHA512ee230ca469d313dcfcbdd4f897e944eb8a86f74c895e71192c5a2af95ae3c6ebcfb3c2eacab7d650fe661badcd1af90ef7a4e5aa65d03c90d93799d5bf0789bf
-
Filesize
577KB
MD5db9e0f3f4008e075172f1d9a1ef39d2c
SHA1a6ebc84499064780bb4e178c303e8c585ba2b455
SHA256d0294784464065458e9f005fe72e5871091b8d162509270cf5cafe6007961e78
SHA5122f87917361590d4b1c496603177c108ada7c204fdd9c4e5420a9ad087bacd23d1bdde6f5a889cb7b92721315203128a975d1df6f536408b90c157e5dc20a5e14
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD529bab5fa7dbfd951e1c8290a8f4c2ba7
SHA17b86728d64cef9686bd45f2ff6fdc818c11a1bbb
SHA256dda333d8aed86ba750f669280e458ad2fb8d8ad5700a5fe0df584a1c818c481b
SHA5125bb37bffffe297653f91e0601f17b507659bcfe78567e6e1d10506d3c3bea737e7d6374224ecc01f421cff8f74b299eba8fe3152742b2b1c228966a630de1339
-
Filesize
722B
MD5a429a9b0935d5cdd6962bf3b33137acd
SHA1c30b4fcc6a197ae3aa0f5f2f717108db01ee9e8a
SHA2562b13ee46df71661e5172c9ff0ab9ca8e37b0e9d470275173a0638e383f074a32
SHA5124f547f39c401b59363dc60bfb4067bf9b0f6d5c8e96b97a081e2b4d3203c42e6b03ff9c1f380043caaaa4993ea8ec631764509f5ad0eec3b11081b8cfbea598b
-
C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe.exe
Filesize364KB
MD5213eeb5e8f54231f68e5b26a0fc81bd1
SHA11bc31a42536eacbb57d1cd92ec4b5524a82264d2
SHA256b309045509efc205eb35d6037d64640093fde6c54ec5934e329b447417005a50
SHA512ce35c5f453126c98329df141f821c55692f9252549c76921c231d8170df356cda1689e636758519c0b6898f11b5c836cdb4967d296b99f915e4d1980470a083b
-
Filesize
33KB
MD539e2aebdacc63ecaceef4394c1e9829d
SHA1edb6f5b8af0ed1c5c8f3004a4ef88cbf71f110ed
SHA25639c54788ecedf35129aecaf6018ec37859880f7aec519fda671543d2107cc3ff
SHA512322835c38adb97931efc65e013908ebada73efa8a33d45f320fc5c5b80376ac8327b0eecfddce35fc82d1ef2afaa57604f31cd48ebdeb866a87f09c51b7808e6
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf