Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe
-
Size
66KB
-
MD5
11935a78ac4590f052f45439b3c6810f
-
SHA1
fcd8b21acc96ab3f498d53683e04e5c889a80817
-
SHA256
204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831
-
SHA512
d0717631200a38ffb720152288d2692e0f43b16d4db49b01209b2f6b1bbdf6893ae1d29a4d6a450e150794c0dc307a8456ca2dea695fddb4c19c70397324562c
-
SSDEEP
1536:PuPoaYzMXqtGNttyUn01Q78a4Rs2kKzs2Irj5hN:PhaY46tGNttyJQ7KRs2kKzQj5r
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 5152 Logo1_.exe 4868 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\Crashpad\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe File created C:\Windows\Logo1_.exe 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe 5152 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1276 wrote to memory of 5772 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 84 PID 1276 wrote to memory of 5772 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 84 PID 1276 wrote to memory of 5772 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 84 PID 5772 wrote to memory of 5916 5772 net.exe 86 PID 5772 wrote to memory of 5916 5772 net.exe 86 PID 5772 wrote to memory of 5916 5772 net.exe 86 PID 1276 wrote to memory of 5188 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 87 PID 1276 wrote to memory of 5188 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 87 PID 1276 wrote to memory of 5188 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 87 PID 1276 wrote to memory of 5152 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 89 PID 1276 wrote to memory of 5152 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 89 PID 1276 wrote to memory of 5152 1276 204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe 89 PID 5152 wrote to memory of 4988 5152 Logo1_.exe 90 PID 5152 wrote to memory of 4988 5152 Logo1_.exe 90 PID 5152 wrote to memory of 4988 5152 Logo1_.exe 90 PID 4988 wrote to memory of 1288 4988 net.exe 92 PID 4988 wrote to memory of 1288 4988 net.exe 92 PID 4988 wrote to memory of 1288 4988 net.exe 92 PID 5188 wrote to memory of 4868 5188 cmd.exe 93 PID 5188 wrote to memory of 4868 5188 cmd.exe 93 PID 5188 wrote to memory of 4868 5188 cmd.exe 93 PID 5152 wrote to memory of 2096 5152 Logo1_.exe 94 PID 5152 wrote to memory of 2096 5152 Logo1_.exe 94 PID 5152 wrote to memory of 2096 5152 Logo1_.exe 94 PID 2096 wrote to memory of 5656 2096 net.exe 96 PID 2096 wrote to memory of 5656 2096 net.exe 96 PID 2096 wrote to memory of 5656 2096 net.exe 96 PID 5152 wrote to memory of 3396 5152 Logo1_.exe 58 PID 5152 wrote to memory of 3396 5152 Logo1_.exe 58
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe"C:\Users\Admin\AppData\Local\Temp\204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BA.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe"C:\Users\Admin\AppData\Local\Temp\204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe"4⤵
- Executes dropped EXE
PID:4868
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1288
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5656
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD590d69822206b8e980d10a29cea7d01de
SHA17984618563bf7b6f02f085dccc0703e46da11f24
SHA256f8c8eae5776a28c081e2d60d82beba328347cddcacf1779f8de50ff7db2f90e1
SHA512b2f06e660e23689db6185de8837bdf2ca733a51216413485f621e46ecf835d8f269a6a83e4ae3e91e7d8b3f569ddec3e0deeb1baf5cc4aaa05b80623eb3c686d
-
Filesize
577KB
MD534021089aa784bb71f1f7d2dc7425b9b
SHA17e7b4c719eee1a4d4e95aae349409ad178b193ee
SHA256883aa1531ffe6e58b523772781f0c6fe8f4c3d346c32c9750a065a97a076dab7
SHA512787b81683f15b28d50439c8f8b7c6493b43a0cd7e1e3056585b8613361262a64b04b66d42b68542d14883bfc411a3a2d212c2f114b077c3e0c90cc5bd5c968d2
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5c812cad58e4a4cedd3373f5125ed73dc
SHA148cb77381e1c81f5f75e13ee39e35ced130fc784
SHA2561c27223874f6c587ed068134e66e9a0588de3776370bf5f14bfdd246c860d9cf
SHA51272af90d02def9f922ca8d4e621bea562718c8e530039eb22f44e8fc9089ccc4990e0a20b1f2d5761e46af0e579bbd5a666c9176d07b096c751b754a476e6626f
-
Filesize
722B
MD5dd76e39c9afab05b65deba49a9f8be08
SHA1f52a79b678d4faf864b9e4b52419d84ca32a1e49
SHA256b18f48942622cbda69d6b47d6af63e4c37674391ca3b4e7e6241b03244315052
SHA51286d9aa82dc3acca0bd32a83456bc59c2ee254cfcf3005d9c003ddb914e83f851b7b1bd4e5ef6d07cd9918c47e4df1983cb9d18ac7bd37bd3a27f85eff17310f5
-
C:\Users\Admin\AppData\Local\Temp\204c2f1c9a9445ca2194aecebff5a7eabd8502525659fb1f3783d7cbcca13831.exe.exe
Filesize33KB
MD597ec61761e1fdfb2f1d4ea4d221a43d1
SHA1d6e1682a8dd967bdffe8c145731fb9ea1d0a3509
SHA2561f3069b596484ffa16181226b07c67ee1cb0f41d191ddde7c02f6bb75336cc52
SHA5127d34cc27dce09e2711d76f39c5f44525937ac15723aaedc303c154223f3ec42e6043374582614cc3067795781a2daf6ea8935f3f3b0a8747fa783cedf36090a9
-
Filesize
33KB
MD54674ed865526038d8119445bb553f2b3
SHA197748b9e405e0f585e3d53fea53017d42994f311
SHA256bc3afb605b77075a2bc94b73ffa22e4402fc9e3362806ad293c4198ea81fd51f
SHA512e1b2a929cf3b7f66934c1df530c49345da935c51e56a66f271397a971639eb2ea37eda451bffc90bc788865c9fa22359530508d0245efe6045aa182ecb5b7e2d
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD55412111268dd2c1fb1cf8697bfab9b6c
SHA116d0b289e83c74cb50a004edd7c5750ac706f321
SHA256f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
SHA51213fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf