Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
General
-
Target
d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe
-
Size
101KB
-
MD5
4b5510f03ab8f5e2f2a415eb6ff3b65a
-
SHA1
dded819073c878c657071d468f30c702f8c9f702
-
SHA256
d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04
-
SHA512
c19c3aecf1eba1aad9a9e9cf19590badc986942569d5075e574f9a88e91d61496066b3e2fa13502b3d0b73b0543821947d73b715850cbe26fac7bf40a1602ff0
-
SSDEEP
1536:2MaYzMXqtGNttyeiZnZLYm12WtwXaa8NPI9j+RedcP01ic4Brg:2MaY46tGNttyeQLYm12WtwXwKRj1EBrg
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2532 Logo1_.exe 3936 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe File created C:\Windows\Logo1_.exe d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe 2532 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2296 wrote to memory of 3464 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 84 PID 2296 wrote to memory of 3464 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 84 PID 2296 wrote to memory of 3464 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 84 PID 3464 wrote to memory of 3592 3464 net.exe 86 PID 3464 wrote to memory of 3592 3464 net.exe 86 PID 3464 wrote to memory of 3592 3464 net.exe 86 PID 2296 wrote to memory of 3012 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 87 PID 2296 wrote to memory of 3012 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 87 PID 2296 wrote to memory of 3012 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 87 PID 2296 wrote to memory of 2532 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 89 PID 2296 wrote to memory of 2532 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 89 PID 2296 wrote to memory of 2532 2296 d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe 89 PID 2532 wrote to memory of 3568 2532 Logo1_.exe 90 PID 2532 wrote to memory of 3568 2532 Logo1_.exe 90 PID 2532 wrote to memory of 3568 2532 Logo1_.exe 90 PID 3012 wrote to memory of 3936 3012 cmd.exe 92 PID 3012 wrote to memory of 3936 3012 cmd.exe 92 PID 3012 wrote to memory of 3936 3012 cmd.exe 92 PID 3568 wrote to memory of 4788 3568 net.exe 93 PID 3568 wrote to memory of 4788 3568 net.exe 93 PID 3568 wrote to memory of 4788 3568 net.exe 93 PID 2532 wrote to memory of 4460 2532 Logo1_.exe 94 PID 2532 wrote to memory of 4460 2532 Logo1_.exe 94 PID 2532 wrote to memory of 4460 2532 Logo1_.exe 94 PID 4460 wrote to memory of 116 4460 net.exe 96 PID 4460 wrote to memory of 116 4460 net.exe 96 PID 4460 wrote to memory of 116 4460 net.exe 96 PID 2532 wrote to memory of 3428 2532 Logo1_.exe 56 PID 2532 wrote to memory of 3428 2532 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe"C:\Users\Admin\AppData\Local\Temp\d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8944.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe"C:\Users\Admin\AppData\Local\Temp\d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe"4⤵
- Executes dropped EXE
PID:3936
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4788
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:116
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5800a15b73ebd38e1c3fab0438e16bbfc
SHA11fe5fa583af497f1606e8acff64e7277d9156881
SHA25657f0772a1df0d0082fbc97f9245d3bb36d2d3edfdb49711fa28fd724750ec42e
SHA512401f7cc7e2018bb4d456f21c34c174772a7422563c4272f4b0ca6b26a362d40c7dc435251b49e701aff45251fdd7488c3d9509283f36b3c6bd2923e4dc860983
-
Filesize
432KB
MD5ab377eb2c6d8eb30ca9f0d79fae84eae
SHA14779f9a686b317d9037aca81a040c61a78d66b9e
SHA2562233bed019ce12b6f8a7d1112c5a97b15ba206e6de812436d2428424851c0843
SHA51268a6f6f99d268269bc7e9c43c6b236aa4f39234a67b16d55a01d4bc88ecca380775e6f6d81026f91bd8db54897c1f04e57304bae9ccd6ef5a11f0e462ef75646
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5b84328b001ca8f8af6bb91f3412d6c8d
SHA14dc7c1302ec956ad23588e6e118b529a00f78bf3
SHA2567c66229128ddbb08a813f4e100c4669b0c911f85b2533b5a98c5b9c3ba1382e5
SHA5123873f467b402c8cb5a09cbbc595ea38c5638aa16c008d59ddbca6ba7d7eee1fa8fc84f910de61853e3d1fe74c8bc578127165c5ce3bf1582753885b2cd8e0bc7
-
Filesize
722B
MD58f031d0e6281f427d5dfba14ec2e5dc0
SHA150915c1d5db158e63435d519345e180674c0fa65
SHA256081798f51756b36da29768a15d664c5412e570375ff6de3d1b2d62b9bc6e144d
SHA5120c339b0c91bf5d9dbf46edce1d5529e76839ba7cb788ea17a63fa8837184b712c978511da6c15823463fd132328da8b79ba3df32049f08df876da296305ec7a3
-
C:\Users\Admin\AppData\Local\Temp\d9ffb413e839a66ccb01f3cfd2aad77f0dd39ad32c256810df70c399ee529f04.exe.exe
Filesize68KB
MD548335cfbe6a9bdaa2492ca1320b70a3a
SHA16d3c3d659e3718a0b56f52c9d4386d55d7672b97
SHA2564ec34f1d893e8cc02f669fb5eb329bbcc5374bd7e7284e8fd86fbc29d2ffeb4d
SHA5129eaf3b380449ab1d2b4b6371336fc71f6a43eee0295de012d0859e7f3b80a87f9d8316b0e65d4ca450630ee17b95c64e79e594bfe27fb3965917b0c5bc2d1b58
-
Filesize
33KB
MD5882c518784a2516cf3382e811730a54b
SHA1f005942b284152bccdaf2e9daf8dc8b7ec42ab19
SHA256ed39c0d5d432a79b3535a497fdf7c83948f570ec1b744ce2c5d810ba4db5aa7f
SHA51231937e85e1599160c659d430368ea36e9206bef58d98cc3642a4a8795197f7e5df96f6babbffa3d96e7b9afbb0284f03031fa6ef7361d010593df4055772093a
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD5e02899454c67c7d6d1af854fdcb53b67
SHA126fb213f7c299c2a4d8c4afd234ee0b751d7a30e
SHA2560e67e90646d3ba7b46f935b205c9f89e8bff2dca7aeda3cd5dfb93868b262315
SHA512e1519bebf62ab4cb28e630a201312812e04f815ec0663f7b68b478da97c0bf7c7c2238a8632540d3d1f37acbe83919fb198b39ebeb222c19faa2130ab65ffffa