Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 17:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe
-
Size
115KB
-
MD5
b0aedce6d28bec257ebbe0fc4aeda283
-
SHA1
38c8de6feecd951b8d75ddd29d5dee11045d9def
-
SHA256
cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4
-
SHA512
062a925d65b0ca45781a932712389b34d985aea13850a54fce0c71737034c630dde83c9be6fb26332909e3534382e9e91acccb2b0fccf9ab1d1e4362d1051a2c
-
SSDEEP
3072:2MaY46tGNttyeQLYm1D2ebrEFEIkJbHljDFEJK0u9y:H46tGdye41yebrESIkJbFjJAu4
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2520 Logo1_.exe 5076 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe 2520 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2320 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 82 PID 2540 wrote to memory of 2320 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 82 PID 2540 wrote to memory of 2320 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 82 PID 2320 wrote to memory of 3080 2320 net.exe 84 PID 2320 wrote to memory of 3080 2320 net.exe 84 PID 2320 wrote to memory of 3080 2320 net.exe 84 PID 2540 wrote to memory of 1224 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 85 PID 2540 wrote to memory of 1224 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 85 PID 2540 wrote to memory of 1224 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 85 PID 2540 wrote to memory of 2520 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 87 PID 2540 wrote to memory of 2520 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 87 PID 2540 wrote to memory of 2520 2540 cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe 87 PID 2520 wrote to memory of 1796 2520 Logo1_.exe 88 PID 2520 wrote to memory of 1796 2520 Logo1_.exe 88 PID 2520 wrote to memory of 1796 2520 Logo1_.exe 88 PID 1224 wrote to memory of 5076 1224 cmd.exe 90 PID 1224 wrote to memory of 5076 1224 cmd.exe 90 PID 1224 wrote to memory of 5076 1224 cmd.exe 90 PID 1796 wrote to memory of 3616 1796 net.exe 91 PID 1796 wrote to memory of 3616 1796 net.exe 91 PID 1796 wrote to memory of 3616 1796 net.exe 91 PID 2520 wrote to memory of 1916 2520 Logo1_.exe 92 PID 2520 wrote to memory of 1916 2520 Logo1_.exe 92 PID 2520 wrote to memory of 1916 2520 Logo1_.exe 92 PID 1916 wrote to memory of 2496 1916 net.exe 94 PID 1916 wrote to memory of 2496 1916 net.exe 94 PID 1916 wrote to memory of 2496 1916 net.exe 94 PID 2520 wrote to memory of 3548 2520 Logo1_.exe 56 PID 2520 wrote to memory of 3548 2520 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe"C:\Users\Admin\AppData\Local\Temp\cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a802C.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe"C:\Users\Admin\AppData\Local\Temp\cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe"4⤵
- Executes dropped EXE
PID:5076
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3616
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5800a15b73ebd38e1c3fab0438e16bbfc
SHA11fe5fa583af497f1606e8acff64e7277d9156881
SHA25657f0772a1df0d0082fbc97f9245d3bb36d2d3edfdb49711fa28fd724750ec42e
SHA512401f7cc7e2018bb4d456f21c34c174772a7422563c4272f4b0ca6b26a362d40c7dc435251b49e701aff45251fdd7488c3d9509283f36b3c6bd2923e4dc860983
-
Filesize
636KB
MD5ef9f3dec96e40e6499ebeba1e56e9bd1
SHA16bd78fa28100d3bc48531aeaf66516dc8cd47368
SHA256040a50f75f713ef4ef68fcbbe12feca1f325e387b23d4089796c5ddc5f7a5618
SHA512735375adc03bace594fb25abf79d51ff291a925ebd63539225cfd0136ffd64e5c8c222155da64f2d81e5257d772442ea1921a7e446e016904432e0d1fca4f33e
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5b84328b001ca8f8af6bb91f3412d6c8d
SHA14dc7c1302ec956ad23588e6e118b529a00f78bf3
SHA2567c66229128ddbb08a813f4e100c4669b0c911f85b2533b5a98c5b9c3ba1382e5
SHA5123873f467b402c8cb5a09cbbc595ea38c5638aa16c008d59ddbca6ba7d7eee1fa8fc84f910de61853e3d1fe74c8bc578127165c5ce3bf1582753885b2cd8e0bc7
-
Filesize
722B
MD52e7c909a9c4c03aef29b3217710f9ff5
SHA19e3d07e7b9ded305b9cab995c25fc8a0234d2c13
SHA25622e1c200f778413667cc8032794aeeb89628b095bae172920b769e52e23a981d
SHA51208c706976db86eddfe29dd976df46b723f8accdb46f0c47bce4fb0b9428044ef3ac77acc88b3787579791407c505f09951f4d35aa5309b45a57160817b54d102
-
C:\Users\Admin\AppData\Local\Temp\cce956f2f4c805f15d28d96174be5ee64685959a937a308e1145b50e9a85bad4.exe.exe
Filesize81KB
MD5555d7a9a45844e061845877f095d017b
SHA14b4269c1e2e29cd78c141fb66bb2965b04411033
SHA256e86340a88f90a53d01d26629d517889aa12f5dc0150e5cb0bf8731bc2bce96ca
SHA512c243d3bd51b891aff87718019d964189dee4f783ecef1f15bf0e2a378367e99d9844cbd527c70f5d6df373dd171da4bce03f4632e55c98e7bcc3335f20b0eb16
-
Filesize
33KB
MD5882c518784a2516cf3382e811730a54b
SHA1f005942b284152bccdaf2e9daf8dc8b7ec42ab19
SHA256ed39c0d5d432a79b3535a497fdf7c83948f570ec1b744ce2c5d810ba4db5aa7f
SHA51231937e85e1599160c659d430368ea36e9206bef58d98cc3642a4a8795197f7e5df96f6babbffa3d96e7b9afbb0284f03031fa6ef7361d010593df4055772093a
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD5e02899454c67c7d6d1af854fdcb53b67
SHA126fb213f7c299c2a4d8c4afd234ee0b751d7a30e
SHA2560e67e90646d3ba7b46f935b205c9f89e8bff2dca7aeda3cd5dfb93868b262315
SHA512e1519bebf62ab4cb28e630a201312812e04f815ec0663f7b68b478da97c0bf7c7c2238a8632540d3d1f37acbe83919fb198b39ebeb222c19faa2130ab65ffffa