Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 14:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe
-
Size
66KB
-
MD5
4fb487529015ff51edde64445286e1e1
-
SHA1
b8f31ace306e77d368c647911da0c60009c14379
-
SHA256
49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d
-
SHA512
3ed32810cfbb5b2a7c86c0e959b35dad36b1df5fb125fe45787adc35939d582a19ec73c918fd073c6d4c17b8f5c470187af13cfe0d6ca1e1a5a1605610497631
-
SSDEEP
768:2UmNHp+Vxr1x5cE9Fl5pz8w1rU9hFInlItvVhoEqzjQCyGleXNhyaBt6UkAkBJzz:2fpsrz8GvnGtvVfqzlledcTJzz
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4724 Logo1_.exe 2324 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Services\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe File created C:\Windows\Logo1_.exe 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe 4724 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3196 wrote to memory of 5064 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 82 PID 3196 wrote to memory of 5064 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 82 PID 3196 wrote to memory of 5064 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 82 PID 5064 wrote to memory of 4896 5064 net.exe 84 PID 5064 wrote to memory of 4896 5064 net.exe 84 PID 5064 wrote to memory of 4896 5064 net.exe 84 PID 3196 wrote to memory of 1760 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 85 PID 3196 wrote to memory of 1760 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 85 PID 3196 wrote to memory of 1760 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 85 PID 3196 wrote to memory of 4724 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 87 PID 3196 wrote to memory of 4724 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 87 PID 3196 wrote to memory of 4724 3196 49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe 87 PID 4724 wrote to memory of 1972 4724 Logo1_.exe 88 PID 4724 wrote to memory of 1972 4724 Logo1_.exe 88 PID 4724 wrote to memory of 1972 4724 Logo1_.exe 88 PID 1760 wrote to memory of 2324 1760 cmd.exe 90 PID 1760 wrote to memory of 2324 1760 cmd.exe 90 PID 1760 wrote to memory of 2324 1760 cmd.exe 90 PID 1972 wrote to memory of 2572 1972 net.exe 91 PID 1972 wrote to memory of 2572 1972 net.exe 91 PID 1972 wrote to memory of 2572 1972 net.exe 91 PID 4724 wrote to memory of 1580 4724 Logo1_.exe 92 PID 4724 wrote to memory of 1580 4724 Logo1_.exe 92 PID 4724 wrote to memory of 1580 4724 Logo1_.exe 92 PID 1580 wrote to memory of 1504 1580 net.exe 94 PID 1580 wrote to memory of 1504 1580 net.exe 94 PID 1580 wrote to memory of 1504 1580 net.exe 94 PID 4724 wrote to memory of 3600 4724 Logo1_.exe 56 PID 4724 wrote to memory of 3600 4724 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe"C:\Users\Admin\AppData\Local\Temp\49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC081.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe"C:\Users\Admin\AppData\Local\Temp\49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe"4⤵
- Executes dropped EXE
PID:2324
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2572
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1504
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD57864a3f777019c73ad26ab282fdaba77
SHA1c46f6b0c3503911395a1d13ac2f7884a20a76382
SHA256f3117732a9955b7a81629f8f4e3feba53ff1f1491c2c49c6b2d76a1fa64b0545
SHA51294191a3fde694d248ace8d212253821f502d5e592ab2f4cb1d137c7c55645d218b48839a00e8a87a6e5ef31138e700e3e56c2b6d84e0c4e8291394df45261645
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD59044b8cb7dee805474f46fdff328cebb
SHA11cabc4c6c2c86cbb78765bc9dbc34fb343a473d2
SHA25662fedddac5d2bc0012582f6d5c8a62f1cfeb146338ded33892f3e2e9a3080618
SHA5124c3baf797abb9745bd194cb39da4f7541273d5ceb694929e562b3823118a8851a9b5dde4379d3936ca8fc233339560f7716518a62b421a2fcfe228d1037d9753
-
Filesize
722B
MD55173566a3bbbc5523ac20375de014bbe
SHA1f8418ade095fd5410d154eb6eb0c07ce19932712
SHA256da0537648067276a768fe8d28462d3f5edbf2e449e927f046155203a1954ad46
SHA512b6cbf9a36abea65b11a68091f78d21c902304f4adef570f405aae4fd78b56394483b763b29319288b4e5317551e06b2c73f08ed7e82f6cc785d39f1d2250d57a
-
C:\Users\Admin\AppData\Local\Temp\49387e11c69e53ae0ee354a3949c8b3b6b33c795421c6bfdb0bfc143022d8d7d.exe.exe
Filesize33KB
MD564f8db30b16d1c755d033d069c70d2d1
SHA104e8f26c383027cc63531f48477424bda65b14e5
SHA2560823bf7a2c453892ffa4328a970a417e0907d584bfb7f819ed0f4bb139d12e55
SHA512f461b40de656e6df6360a1ba393b000720c0ffa91147b00ee42aefccb4122da4314ce4de00364e692a0517f5e6643fe061b232fb316e993642f2d43b393b38aa
-
Filesize
33KB
MD53253bf7588138d1e39d3105c7b5dc8b9
SHA1b26c43ff51ce241d473aa3efa30cd3b3bc68e43a
SHA25663554e061f95eb7f63c9d50e7c14fc88c1cbf4db277efaefe1bea2388f9ed5e0
SHA512cd45a96ada3daa5d2386ef9d5ded03a7e1e6f5c800bf01d02c1289c2e5234b8ed2b430ad0438837b32da22a753d07b0d1ee918dca8567a8c6c3619a8050c3bd5
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf