Analysis
-
max time kernel
149s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe
-
Size
394KB
-
MD5
7e469a961fedc0c0d89f1e446f8c98db
-
SHA1
7a415b177ab12310a45eda6c8e42b650a902a31e
-
SHA256
60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1
-
SHA512
1786c5836c887a64803937c3fa411c5e2d35748a486427b91dba938763c2c1e6c317b943e12329e60dde05610787a4f5f22042edf1ab39114b69fd5691c29454
-
SSDEEP
6144:t46tGdye412P2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuz:t3NbZahVy41
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4840 Logo1_.exe 4764 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe File created C:\Windows\Logo1_.exe 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe 4840 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4300 wrote to memory of 1728 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 82 PID 4300 wrote to memory of 1728 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 82 PID 4300 wrote to memory of 1728 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 82 PID 1728 wrote to memory of 3792 1728 net.exe 84 PID 1728 wrote to memory of 3792 1728 net.exe 84 PID 1728 wrote to memory of 3792 1728 net.exe 84 PID 4300 wrote to memory of 3900 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 85 PID 4300 wrote to memory of 3900 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 85 PID 4300 wrote to memory of 3900 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 85 PID 4300 wrote to memory of 4840 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 87 PID 4300 wrote to memory of 4840 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 87 PID 4300 wrote to memory of 4840 4300 60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe 87 PID 4840 wrote to memory of 696 4840 Logo1_.exe 88 PID 4840 wrote to memory of 696 4840 Logo1_.exe 88 PID 4840 wrote to memory of 696 4840 Logo1_.exe 88 PID 696 wrote to memory of 4404 696 net.exe 90 PID 696 wrote to memory of 4404 696 net.exe 90 PID 696 wrote to memory of 4404 696 net.exe 90 PID 3900 wrote to memory of 4764 3900 cmd.exe 91 PID 3900 wrote to memory of 4764 3900 cmd.exe 91 PID 4840 wrote to memory of 4100 4840 Logo1_.exe 92 PID 4840 wrote to memory of 4100 4840 Logo1_.exe 92 PID 4840 wrote to memory of 4100 4840 Logo1_.exe 92 PID 4100 wrote to memory of 4856 4100 net.exe 94 PID 4100 wrote to memory of 4856 4100 net.exe 94 PID 4100 wrote to memory of 4856 4100 net.exe 94 PID 4840 wrote to memory of 3524 4840 Logo1_.exe 56 PID 4840 wrote to memory of 3524 4840 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe"C:\Users\Admin\AppData\Local\Temp\60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6959.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe"C:\Users\Admin\AppData\Local\Temp\60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe"4⤵
- Executes dropped EXE
PID:4764
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4404
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4856
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD55a601c61bec40b82ed77d3a992d8c24b
SHA1a8f779cfcfe4d4537a49d08bd942e5b2fc0dc818
SHA256aa3042b0faa26b13bad030bbe22a1bdc26fe69eeb04b03eb9def56f6c4688c96
SHA5125100ca65103d69f5a97e4309f21c571a418d2d1071cf1e9388e65970cb328a91b3b03284a0b40ec78f9666689b31e97d4bdf324967827535334f398da59605bc
-
Filesize
577KB
MD5f62138746b7d65ac3d4ac68922da0dc9
SHA130f1b630d5ea10dbd17713663ac480713405d7d2
SHA25627cfc8af28cb9bf686279d28eddb09d9786d81cb9135c8ea9e34d2591cb2c9fd
SHA51281484627ff6ca9c36c16b8cac151c8684f9691a9536206ff20ceb844619aebc9bfece73b9d89664b7ba9e83c59716d72cb2fd78691c2e8c4faeb672b4385287d
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD585f79b883012dd5dc037b06f462adac7
SHA1f12851feae4f0bcf48d0d462f45f2decbf94967a
SHA256b336dfcbf2ef97806dd0f82228a4a803a6bd3ca71c8388dc1da04dff8c359b34
SHA512e2abde81d4f1c7c8dd590b6a92b5035e7ec86bcd71b5509065a15912b633989baa8f1f610552098a77f1d43b7516e6042b190c446193ce26a2173ca17c6ca2f9
-
Filesize
722B
MD508a2f55517f05defc661f9af1a6c58c3
SHA1769af70b1a4e66e9be307f22d16789871625b475
SHA2567040341e4977485fbc4d9a3c6040856747b8ca0c7424b9dabcc3c60a455818da
SHA512369381d08060551ae6afd904e22d7306b53349fcf050f8d721196528ffb990dec1fff3532ffc3f01a4e4a4bc1cc59fbcf733524585e489305bf32a71e922237d
-
C:\Users\Admin\AppData\Local\Temp\60899e1d990b1d67f4b892530019333df85bc5b1b962c3c0f24555d51a850fa1.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
33KB
MD5beb95acb4c15833bdd7b09dd53c78930
SHA13375e35d1faa90c7ca5b60457ed2f4aed915153a
SHA25659d640e8db52cd783338125429e8adef0ba3bb6c6c6e9f5c112732a7ad88c003
SHA512f22074d8930af86ca1bead0f2973241c129aee323953df791598b3141147e900679cb42f12ec85f926451f8f0a7219fbbc6ac5a5e4523e7e388309f1b7b5369d
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf