Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 14:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe
-
Size
67KB
-
MD5
59640d38066259d1b0d70b1832e1054b
-
SHA1
10114f09e115159ec591a5741c08bf99e6d7a710
-
SHA256
cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf
-
SHA512
f9ad335b69aaef13b03d1c92acc5b08bfef16b43c96c9313e932afdc96e722eff438857e66900a33a992c829b076c8fa05aa786be2c22d085411ff6694c3563d
-
SSDEEP
1536:2MaYzMXqtGNttyeiZnZLYm1NiS4qz0XSW3iDhy3:2MaY46tGNttyeQLYm1wS4qz3DhO
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3364 Logo1_.exe 2928 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File created C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe File created C:\Windows\Logo1_.exe cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe 3364 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 220 wrote to memory of 4452 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 82 PID 220 wrote to memory of 4452 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 82 PID 220 wrote to memory of 4452 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 82 PID 4452 wrote to memory of 3052 4452 net.exe 84 PID 4452 wrote to memory of 3052 4452 net.exe 84 PID 4452 wrote to memory of 3052 4452 net.exe 84 PID 220 wrote to memory of 2268 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 85 PID 220 wrote to memory of 2268 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 85 PID 220 wrote to memory of 2268 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 85 PID 220 wrote to memory of 3364 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 87 PID 220 wrote to memory of 3364 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 87 PID 220 wrote to memory of 3364 220 cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe 87 PID 3364 wrote to memory of 2140 3364 Logo1_.exe 88 PID 3364 wrote to memory of 2140 3364 Logo1_.exe 88 PID 3364 wrote to memory of 2140 3364 Logo1_.exe 88 PID 2140 wrote to memory of 1300 2140 net.exe 90 PID 2140 wrote to memory of 1300 2140 net.exe 90 PID 2140 wrote to memory of 1300 2140 net.exe 90 PID 2268 wrote to memory of 2928 2268 cmd.exe 91 PID 2268 wrote to memory of 2928 2268 cmd.exe 91 PID 2268 wrote to memory of 2928 2268 cmd.exe 91 PID 3364 wrote to memory of 4936 3364 Logo1_.exe 92 PID 3364 wrote to memory of 4936 3364 Logo1_.exe 92 PID 3364 wrote to memory of 4936 3364 Logo1_.exe 92 PID 4936 wrote to memory of 3380 4936 net.exe 94 PID 4936 wrote to memory of 3380 4936 net.exe 94 PID 4936 wrote to memory of 3380 4936 net.exe 94 PID 3364 wrote to memory of 3388 3364 Logo1_.exe 56 PID 3364 wrote to memory of 3388 3364 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe"C:\Users\Admin\AppData\Local\Temp\cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F54.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe"C:\Users\Admin\AppData\Local\Temp\cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe"4⤵
- Executes dropped EXE
PID:2928
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1300
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3380
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5800a15b73ebd38e1c3fab0438e16bbfc
SHA11fe5fa583af497f1606e8acff64e7277d9156881
SHA25657f0772a1df0d0082fbc97f9245d3bb36d2d3edfdb49711fa28fd724750ec42e
SHA512401f7cc7e2018bb4d456f21c34c174772a7422563c4272f4b0ca6b26a362d40c7dc435251b49e701aff45251fdd7488c3d9509283f36b3c6bd2923e4dc860983
-
Filesize
577KB
MD544773e05dfe58cc6e3129ccf18cdc060
SHA197e00f69c4d47c6b46b85ddf85a45a99c3b2e5e6
SHA256d76bf8b9195061b82e454ab09270b71930b68d6f4bf77a2c3d55dc475b207943
SHA51256aa775567a18a4fe2c41216617568280b44a724eec1c733491309cfa88fbae256fb1aed417c669f20b0cb5f0ef7aa2e12c0f2d560fcba79377200221095adbe
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5b84328b001ca8f8af6bb91f3412d6c8d
SHA14dc7c1302ec956ad23588e6e118b529a00f78bf3
SHA2567c66229128ddbb08a813f4e100c4669b0c911f85b2533b5a98c5b9c3ba1382e5
SHA5123873f467b402c8cb5a09cbbc595ea38c5638aa16c008d59ddbca6ba7d7eee1fa8fc84f910de61853e3d1fe74c8bc578127165c5ce3bf1582753885b2cd8e0bc7
-
Filesize
722B
MD52580a89473891718d21f568c273c3fb5
SHA1def3bc000d1e6539b460bee6e391a0eae71716ee
SHA25641be4a3d6669775d43f5d95f8fe7664c92d709b109c4748073745fbe8b3f01d7
SHA512debba967949ebd976f21d3695064f2af0b4caa3f2e8abcf5e208b95703a279f65e477d376b440c8a00fffb9616bace2d9748ada090c2857f52bf758919eccd7e
-
C:\Users\Admin\AppData\Local\Temp\cfe27495b7889a08095555a4a6a221fc5d8ae4cbadc33d2280947d52fcbfd9cf.exe.exe
Filesize33KB
MD5e23f654ce94c5fea4bc1d10bac9e1705
SHA18bf96eb96181339a2c0f261768045546503d7545
SHA25674d75e8cd9f52cd9b294bd8203d21c83009824890811174af2601795a2bffe6c
SHA512c9021cec17d19bfea97d6c038747f6c0a387934d3700e058b4ffad41f9d4805771c52739c5f9efdf69db099a52fc48040e7fed692acbea0398b3ffe843f9fce6
-
Filesize
33KB
MD5882c518784a2516cf3382e811730a54b
SHA1f005942b284152bccdaf2e9daf8dc8b7ec42ab19
SHA256ed39c0d5d432a79b3535a497fdf7c83948f570ec1b744ce2c5d810ba4db5aa7f
SHA51231937e85e1599160c659d430368ea36e9206bef58d98cc3642a4a8795197f7e5df96f6babbffa3d96e7b9afbb0284f03031fa6ef7361d010593df4055772093a
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD5e02899454c67c7d6d1af854fdcb53b67
SHA126fb213f7c299c2a4d8c4afd234ee0b751d7a30e
SHA2560e67e90646d3ba7b46f935b205c9f89e8bff2dca7aeda3cd5dfb93868b262315
SHA512e1519bebf62ab4cb28e630a201312812e04f815ec0663f7b68b478da97c0bf7c7c2238a8632540d3d1f37acbe83919fb198b39ebeb222c19faa2130ab65ffffa