Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe
-
Size
165KB
-
MD5
043b405145b4f79e81b3f4e407b1a401
-
SHA1
f7c9842e2ca8e33a17ad083507672d568be764b2
-
SHA256
620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd
-
SHA512
180794bc15d3626adad999f6a8b6a733f041e748c699622b46428811c7c58502bf1d131a02d02abcbc0ba8e5c0af6ef152a9a6b8e1592e36588674c687b4e626
-
SSDEEP
3072:2MaY46tGNttyeQLYm1s99djmMGWBgh1002J8emEu3T7TO+9Z9sTOVrZzxVxU:H46tGdye41WYWBW1Wu3rOOuOVr8
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1768 Logo1_.exe 2268 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Crashpad\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe File created C:\Windows\Logo1_.exe 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe 1768 Logo1_.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2268 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 2268 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3468 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 82 PID 2128 wrote to memory of 3468 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 82 PID 2128 wrote to memory of 3468 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 82 PID 3468 wrote to memory of 4228 3468 net.exe 84 PID 3468 wrote to memory of 4228 3468 net.exe 84 PID 3468 wrote to memory of 4228 3468 net.exe 84 PID 2128 wrote to memory of 4992 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 85 PID 2128 wrote to memory of 4992 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 85 PID 2128 wrote to memory of 4992 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 85 PID 2128 wrote to memory of 1768 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 87 PID 2128 wrote to memory of 1768 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 87 PID 2128 wrote to memory of 1768 2128 620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe 87 PID 1768 wrote to memory of 4424 1768 Logo1_.exe 88 PID 1768 wrote to memory of 4424 1768 Logo1_.exe 88 PID 1768 wrote to memory of 4424 1768 Logo1_.exe 88 PID 4992 wrote to memory of 2268 4992 cmd.exe 90 PID 4992 wrote to memory of 2268 4992 cmd.exe 90 PID 4424 wrote to memory of 1180 4424 net.exe 91 PID 4424 wrote to memory of 1180 4424 net.exe 91 PID 4424 wrote to memory of 1180 4424 net.exe 91 PID 1768 wrote to memory of 3192 1768 Logo1_.exe 92 PID 1768 wrote to memory of 3192 1768 Logo1_.exe 92 PID 1768 wrote to memory of 3192 1768 Logo1_.exe 92 PID 3192 wrote to memory of 3128 3192 net.exe 94 PID 3192 wrote to memory of 3128 3192 net.exe 94 PID 3192 wrote to memory of 3128 3192 net.exe 94 PID 1768 wrote to memory of 3432 1768 Logo1_.exe 56 PID 1768 wrote to memory of 3432 1768 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe"C:\Users\Admin\AppData\Local\Temp\620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7753.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe"C:\Users\Admin\AppData\Local\Temp\620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2268
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3128
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5800a15b73ebd38e1c3fab0438e16bbfc
SHA11fe5fa583af497f1606e8acff64e7277d9156881
SHA25657f0772a1df0d0082fbc97f9245d3bb36d2d3edfdb49711fa28fd724750ec42e
SHA512401f7cc7e2018bb4d456f21c34c174772a7422563c4272f4b0ca6b26a362d40c7dc435251b49e701aff45251fdd7488c3d9509283f36b3c6bd2923e4dc860983
-
Filesize
577KB
MD544773e05dfe58cc6e3129ccf18cdc060
SHA197e00f69c4d47c6b46b85ddf85a45a99c3b2e5e6
SHA256d76bf8b9195061b82e454ab09270b71930b68d6f4bf77a2c3d55dc475b207943
SHA51256aa775567a18a4fe2c41216617568280b44a724eec1c733491309cfa88fbae256fb1aed417c669f20b0cb5f0ef7aa2e12c0f2d560fcba79377200221095adbe
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5b84328b001ca8f8af6bb91f3412d6c8d
SHA14dc7c1302ec956ad23588e6e118b529a00f78bf3
SHA2567c66229128ddbb08a813f4e100c4669b0c911f85b2533b5a98c5b9c3ba1382e5
SHA5123873f467b402c8cb5a09cbbc595ea38c5638aa16c008d59ddbca6ba7d7eee1fa8fc84f910de61853e3d1fe74c8bc578127165c5ce3bf1582753885b2cd8e0bc7
-
Filesize
722B
MD5767cede332a9805258cf741ce28acd3e
SHA1afc42dbd0102f89325107ee72928113470a72412
SHA2569d285ec2c62b7e23cc1a7eed42552542c516b5b8e12f0f7541b085b96e33432f
SHA5120dcb48d7f706abe3f66dff5ff5a7996d56b146b52ec40c6b144a1ce51d47b3d7301338f834780fd79c91933146ae362d951630f43a8f684c24f34fba738d671f
-
C:\Users\Admin\AppData\Local\Temp\620a2ea5c332a0569c93afd6f5b0d0e80630a3c3c2363d1f06516c25244d2edd.exe.exe
Filesize131KB
MD516438a96a8adb85472ca72da04701b29
SHA1b1f5ee8bc083804de4de820255107f6541c84735
SHA2569291cd97d2f1b119438f16e97ea75119f19fd959ec5414e84b337530d692e289
SHA51258f659a29cb34245a261b7666b1cda4b76f2df1039f3713dda6ff5a97c33b4cc273b110d10b4131a6a5c13897efcfa9a5ef3031e0e5fb14db1adc0ac1ef25dcd
-
Filesize
33KB
MD5882c518784a2516cf3382e811730a54b
SHA1f005942b284152bccdaf2e9daf8dc8b7ec42ab19
SHA256ed39c0d5d432a79b3535a497fdf7c83948f570ec1b744ce2c5d810ba4db5aa7f
SHA51231937e85e1599160c659d430368ea36e9206bef58d98cc3642a4a8795197f7e5df96f6babbffa3d96e7b9afbb0284f03031fa6ef7361d010593df4055772093a
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD5e02899454c67c7d6d1af854fdcb53b67
SHA126fb213f7c299c2a4d8c4afd234ee0b751d7a30e
SHA2560e67e90646d3ba7b46f935b205c9f89e8bff2dca7aeda3cd5dfb93868b262315
SHA512e1519bebf62ab4cb28e630a201312812e04f815ec0663f7b68b478da97c0bf7c7c2238a8632540d3d1f37acbe83919fb198b39ebeb222c19faa2130ab65ffffa