Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 15:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
General
-
Target
6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe
-
Size
93KB
-
MD5
0b3aa41e7f3985b2f1eaa74cc5ab7a32
-
SHA1
861d59546edef8a88e9bfdf14ab49b72b6379443
-
SHA256
6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1
-
SHA512
c26cc68ac205a6f74223729c6ff8f93ed20fc29d88524b2ef9c264c9a50d2b92b9d99eeecb9d05d253443f18ff93f269dce15b208a4f4cd095a8db603ba6d911
-
SSDEEP
1536:2vaYzMXqtGNttyeiZnZLYm1nHB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:2vaY46tGNttyeQLYm1nhAWJGSCTBf12P
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4768 Logo1_.exe 5028 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{6ADF0E6F-E89E-4071-B634-15DAFC87E007}\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\909C8E3D-5402-4F5E-93CA-22D9A8F57EBC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe File created C:\Windows\Logo1_.exe 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe 4768 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3036 wrote to memory of 764 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 82 PID 3036 wrote to memory of 764 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 82 PID 3036 wrote to memory of 764 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 82 PID 764 wrote to memory of 2816 764 net.exe 84 PID 764 wrote to memory of 2816 764 net.exe 84 PID 764 wrote to memory of 2816 764 net.exe 84 PID 3036 wrote to memory of 3552 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 85 PID 3036 wrote to memory of 3552 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 85 PID 3036 wrote to memory of 3552 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 85 PID 3036 wrote to memory of 4768 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 87 PID 3036 wrote to memory of 4768 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 87 PID 3036 wrote to memory of 4768 3036 6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe 87 PID 4768 wrote to memory of 2152 4768 Logo1_.exe 88 PID 4768 wrote to memory of 2152 4768 Logo1_.exe 88 PID 4768 wrote to memory of 2152 4768 Logo1_.exe 88 PID 3552 wrote to memory of 5028 3552 cmd.exe 90 PID 3552 wrote to memory of 5028 3552 cmd.exe 90 PID 3552 wrote to memory of 5028 3552 cmd.exe 90 PID 2152 wrote to memory of 4160 2152 net.exe 91 PID 2152 wrote to memory of 4160 2152 net.exe 91 PID 2152 wrote to memory of 4160 2152 net.exe 91 PID 4768 wrote to memory of 1168 4768 Logo1_.exe 92 PID 4768 wrote to memory of 1168 4768 Logo1_.exe 92 PID 4768 wrote to memory of 1168 4768 Logo1_.exe 92 PID 1168 wrote to memory of 984 1168 net.exe 94 PID 1168 wrote to memory of 984 1168 net.exe 94 PID 1168 wrote to memory of 984 1168 net.exe 94 PID 4768 wrote to memory of 3452 4768 Logo1_.exe 56 PID 4768 wrote to memory of 3452 4768 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe"C:\Users\Admin\AppData\Local\Temp\6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5A6.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe"C:\Users\Admin\AppData\Local\Temp\6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5028
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4160
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:984
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD534e4b1c3fbe0af431dbfa32a394d538b
SHA1f3244184975b4613fddee62e1df0befe5f1cb023
SHA256cec6257742a6cb48acd9e0c67e5f3dcf31ae37a5a10b21341e017ddf8dfd6bba
SHA512744ecda9422db65edef59ec38a98c757e38f058d5673ffa0d7cc4a1434fa402262f18a98884f33649c9bcae8e334d2453f337a49f6c24effce32b19e1b7e6200
-
Filesize
577KB
MD51d5981eb84e918e433f083dd445f3578
SHA1b3be9cf4be408f589dcff53a0df8ee5f8add3e15
SHA256be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe
SHA512de4d52a73053a693087b5d3e225a67bc9d5164df5fd641c54c7782974b63c2693d88e883c47ab07ba790322439aee1cc48339f22016050b6ac1da3c8f985860f
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD585f79b883012dd5dc037b06f462adac7
SHA1f12851feae4f0bcf48d0d462f45f2decbf94967a
SHA256b336dfcbf2ef97806dd0f82228a4a803a6bd3ca71c8388dc1da04dff8c359b34
SHA512e2abde81d4f1c7c8dd590b6a92b5035e7ec86bcd71b5509065a15912b633989baa8f1f610552098a77f1d43b7516e6042b190c446193ce26a2173ca17c6ca2f9
-
Filesize
722B
MD59e5e78f25036cd0276303dc042f74fe9
SHA148aac70ec7889dcf65d8d16415114e0ed9f66e6d
SHA256f289abfe0a48b6758dba2eedcf014e0a009f5a8a8f6e7e0699cd55a0881767d9
SHA512572997733bc218f9d4434df7ee097e3c0d83299bcdda3e72b900d678b5740f62f89b26267901e420442904dc25d0abbd7b60695abc41bab5249970df7649794c
-
C:\Users\Admin\AppData\Local\Temp\6fcd9124deb2c6136cb8763263587db2637e5906e52b9f22273e0e3493d13ac1.exe.exe
Filesize60KB
MD5ed0fde686788caec4f2cb1ec9c31680c
SHA181ae63b87eaa9fa5637835d2122c50953ae19d34
SHA256e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c
SHA512d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b
-
Filesize
33KB
MD56c2e4d9285e03d13ad3438424d7c0433
SHA1199aa50fc7e1e2cd42d28599027a07bc33c77012
SHA256ed075c4bc2193c36e740c272f806413273c0cd7ecfa182cf31d9f8e0a2e37cc6
SHA512e44c0dc38f8d8af74b121b1b70e7ed883e186178898e07af391858dd38340ad5915f8f079679073c8b1d60900d387764f38557e8bc1d02752fde02c596f4704c
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf