Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 14:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe
-
Size
131KB
-
MD5
1360c2dcae85783ffb74d3d836ea845d
-
SHA1
dae0e7a5dc4cffff8c0db9ad99398e57c16196e0
-
SHA256
fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826
-
SHA512
6d53a59e11d1abc56635a95fc112031d277b4feb9c5f81ae59037d4a6acdced6fd5064770acdc7e818100ee89f1446369962ec88ea775fc9a9d3829c46a3cf72
-
SSDEEP
3072:2HvaY46tGNttyeQLYm1OvgmJAIlwPxX/ZWOFrb:uB46tGdye41xvI+PxBWOFn
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1748 Logo1_.exe 2452 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\909C8E3D-5402-4F5E-93CA-22D9A8F57EBC\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe File created C:\Windows\Logo1_.exe fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe 1748 Logo1_.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2452 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 2452 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4916 wrote to memory of 4628 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 82 PID 4916 wrote to memory of 4628 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 82 PID 4916 wrote to memory of 4628 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 82 PID 4628 wrote to memory of 780 4628 net.exe 84 PID 4628 wrote to memory of 780 4628 net.exe 84 PID 4628 wrote to memory of 780 4628 net.exe 84 PID 4916 wrote to memory of 3460 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 85 PID 4916 wrote to memory of 3460 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 85 PID 4916 wrote to memory of 3460 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 85 PID 4916 wrote to memory of 1748 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 87 PID 4916 wrote to memory of 1748 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 87 PID 4916 wrote to memory of 1748 4916 fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe 87 PID 1748 wrote to memory of 3244 1748 Logo1_.exe 88 PID 1748 wrote to memory of 3244 1748 Logo1_.exe 88 PID 1748 wrote to memory of 3244 1748 Logo1_.exe 88 PID 3460 wrote to memory of 2452 3460 cmd.exe 90 PID 3460 wrote to memory of 2452 3460 cmd.exe 90 PID 3460 wrote to memory of 2452 3460 cmd.exe 90 PID 3244 wrote to memory of 1820 3244 net.exe 91 PID 3244 wrote to memory of 1820 3244 net.exe 91 PID 3244 wrote to memory of 1820 3244 net.exe 91 PID 1748 wrote to memory of 984 1748 Logo1_.exe 92 PID 1748 wrote to memory of 984 1748 Logo1_.exe 92 PID 1748 wrote to memory of 984 1748 Logo1_.exe 92 PID 984 wrote to memory of 3672 984 net.exe 94 PID 984 wrote to memory of 3672 984 net.exe 94 PID 984 wrote to memory of 3672 984 net.exe 94 PID 1748 wrote to memory of 3448 1748 Logo1_.exe 56 PID 1748 wrote to memory of 3448 1748 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe"C:\Users\Admin\AppData\Local\Temp\fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FBA.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe"C:\Users\Admin\AppData\Local\Temp\fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2452
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1820
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5ad49cc293adc3202b706d4f7127d628d
SHA14660eed68d5c97632885a8bd75890aca547cbee0
SHA2565591244c79a8e0e04bbc4e36e6bf4a55ec59b3d3f4b20d027a668c7f60125dcb
SHA512bf1923dfbcb6657d1c6a2a7d7043f51232ae7e148f02f15bc99f458b60c8a3080a1882c8232f598b259b953f8a8ef019d0fc9268af802e42de216645cd3ad1b0
-
Filesize
577KB
MD53ef47512091981bb9d1603c421a688d9
SHA172eba11625662084d535aa4fa2fc4bc86da61fd6
SHA256980fec6a47516939fa753290022964acb7a90e205d0ea14af1d94ca20b37c570
SHA512ac16134d4c065ed8770c8ded8c60a6a142c21fb52a1e7f05f4534a7ff1bae4e27380785231b954b1c6b7f5e91eed18bb81df340912368b264129a82bc76f89f2
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD574f614352141ac4f78c3e59955ed2258
SHA1179465d798ce029d20b16601530037ca9d87563f
SHA256e33cff13b2b5307aaa06fc8f6d15ebe31eeb5ac6ad8d12b4b5c877eb34cca70c
SHA512af736346b2a298b653dccc43a44d852001584bc22c5e00cb959246a0544044587e27ae3af6c253bf68b3dbe24a0badbe0bf55784f704d8e2f703afaed49ae6ae
-
Filesize
722B
MD517b886c9a459b2b1b8831250cc26bd1f
SHA1f1ea9c71552f5d5110a7c882da60f04bc57e774b
SHA256841fba16c32096ee8627da232b9183998979f349c05c9f371fc65024236fb99e
SHA51283f0cdb76455d01d270c760a0cfc2dbba28a21141707a8c5a2da05275509f86533b055dcb852677642e6058c16dcece7459f1baf5dbbe697874891d0e10b4686
-
C:\Users\Admin\AppData\Local\Temp\fcc382622261d1241dce580cd2a65c4f5c26ce90fe0ce7fbb9635ab760e5b826.exe.exe
Filesize97KB
MD5713a30695b671b6e3b19b7d09f9d8409
SHA183916537c86d7dc1043c752f195f04fa42813afe
SHA2566b42e2e9822b99f5f13a6d1f639fa64cc93001266ceb7a7d342da1bce84d5c08
SHA512a450c691e0c8d16519b418b366a260360a57e8511c6975f2e3029c41f30a68d83448126c3d57c9fb36b3a44e839d4bbcaa73e0adfe305a71e04def2fd990cbf7
-
Filesize
33KB
MD5bee6df131a9c9bccab2c2e85139f6842
SHA1d7d095b827384b3b5f4e0cf9b8afb543998f1796
SHA2561a8911fd47aa3e98991935402374717b26afeed5d8eb431edcd4625f1a16f962
SHA5122457aa406a3010ce789237d55fa17fc0f5694c847699af8044f21ea935179ffc69056c0c2ba4ba3eee3158c51afb2d11d2c372eca3e1ca77c44545cb74cd4812
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf