Analysis
-
max time kernel
119s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
General
-
Target
75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe
-
Size
131KB
-
MD5
d7721bcd76bca30cfdb61e716fd71910
-
SHA1
2265f8141db33b9f88676cd10975aac8c54af9cc
-
SHA256
75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4
-
SHA512
198af8aaa958ca3041fb20d25d984891cd03fd7a83d2ddd23234688441bf0517bcb2ab868c97230b89a742137533965ba19d88d2fca46165d6690bfc84413dcd
-
SSDEEP
1536:2+psrz8GvnGRR8Bftg+9t/p4QAILJuCOPdvX/ZWOtnGWxlP:2H8alvgmJAIlwPxX/ZWOFrb
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2576 Logo1_.exe 3432 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Offline\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\9FC6CB38-5C10-4E84-A2B8-DBDBBDBFF3D0\root\vfs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe File created C:\Windows\Logo1_.exe 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe 2576 Logo1_.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3432 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 3432 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 388 wrote to memory of 1896 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 82 PID 388 wrote to memory of 1896 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 82 PID 388 wrote to memory of 1896 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 82 PID 1896 wrote to memory of 1048 1896 net.exe 84 PID 1896 wrote to memory of 1048 1896 net.exe 84 PID 1896 wrote to memory of 1048 1896 net.exe 84 PID 388 wrote to memory of 4716 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 85 PID 388 wrote to memory of 4716 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 85 PID 388 wrote to memory of 4716 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 85 PID 388 wrote to memory of 2576 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 87 PID 388 wrote to memory of 2576 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 87 PID 388 wrote to memory of 2576 388 75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe 87 PID 4716 wrote to memory of 3432 4716 cmd.exe 88 PID 4716 wrote to memory of 3432 4716 cmd.exe 88 PID 4716 wrote to memory of 3432 4716 cmd.exe 88 PID 2576 wrote to memory of 836 2576 Logo1_.exe 89 PID 2576 wrote to memory of 836 2576 Logo1_.exe 89 PID 2576 wrote to memory of 836 2576 Logo1_.exe 89 PID 836 wrote to memory of 3132 836 net.exe 91 PID 836 wrote to memory of 3132 836 net.exe 91 PID 836 wrote to memory of 3132 836 net.exe 91 PID 2576 wrote to memory of 428 2576 Logo1_.exe 92 PID 2576 wrote to memory of 428 2576 Logo1_.exe 92 PID 2576 wrote to memory of 428 2576 Logo1_.exe 92 PID 428 wrote to memory of 4248 428 net.exe 94 PID 428 wrote to memory of 4248 428 net.exe 94 PID 428 wrote to memory of 4248 428 net.exe 94 PID 2576 wrote to memory of 3524 2576 Logo1_.exe 56 PID 2576 wrote to memory of 3524 2576 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe"C:\Users\Admin\AppData\Local\Temp\75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a833A.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe"C:\Users\Admin\AppData\Local\Temp\75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3432
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3132
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4248
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD560268b7b1db590bd8be291cd1cbecd45
SHA12b734b43bc488992dddcfdc6d8c218a3573e1e8e
SHA256f9161f95dd8e9275df931e118b856b98b0cb9364a879a8e3da1e05e2af9b3589
SHA512ac4188bbeef37afc9aadbc3a87920dd6548b88dd7544eba6f3b6e81c867a9c390a9e8de2814ef5e4d30652faebb807eec01bc44acccf48fc63cc2b79762b4f07
-
Filesize
577KB
MD525ca0916c72125a8313ba64b101fd969
SHA19395d8a9e44400208b8479b23521b69478e5441e
SHA25624ca419f3ef5d9b126e5c8a8dd04493de280adbda0a9f14e8a694d7ee6b6222b
SHA512de5482d5dd6fd7a00452ffbb5eb1b4c29d9f18d150092f8e610b51a70f9b9a71ab1576bfac267a6c5ae1656055f6ddf2e7c436b366f75800edeb5e08bba7c26c
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD59044b8cb7dee805474f46fdff328cebb
SHA11cabc4c6c2c86cbb78765bc9dbc34fb343a473d2
SHA25662fedddac5d2bc0012582f6d5c8a62f1cfeb146338ded33892f3e2e9a3080618
SHA5124c3baf797abb9745bd194cb39da4f7541273d5ceb694929e562b3823118a8851a9b5dde4379d3936ca8fc233339560f7716518a62b421a2fcfe228d1037d9753
-
Filesize
728B
MD52eb76a5b98fb0b39ccb572ce9057799d
SHA103ed7596038c759baeb356232e2a94a87c16a405
SHA2566b4c984ed1ede9096ed1826a7b485e4ae4c9a3cc8295543e8e0893f25b3cebc4
SHA5122830ffa4f94927c8d622018f817ee033ee91062ca8761e01ffe701e76a71f5dc39abb7fc9eb9a70df41eb4833a0726a3b6d8dc99fad4e19ab40fa4e138f14750
-
C:\Users\Admin\AppData\Local\Temp\75ba5da4836e5b018790f563c0c292367f579feb37c07742480285bfd45fc6c4N.exe.exe
Filesize97KB
MD5713a30695b671b6e3b19b7d09f9d8409
SHA183916537c86d7dc1043c752f195f04fa42813afe
SHA2566b42e2e9822b99f5f13a6d1f639fa64cc93001266ceb7a7d342da1bce84d5c08
SHA512a450c691e0c8d16519b418b366a260360a57e8511c6975f2e3029c41f30a68d83448126c3d57c9fb36b3a44e839d4bbcaa73e0adfe305a71e04def2fd990cbf7
-
Filesize
33KB
MD59fd9ba751e949c130d66fe9a3ea6248d
SHA1c39ed606f3afb966b21147079c8c7407732cd29a
SHA2561b6840fc07e4e63f663e72e82e7d6dfbcead0894ad5103a500b1689cc9d4eac6
SHA512f2fca4862e5abd737f4b8d2b43246b15f4e0029159e90a100baa44a54468734bdbaf3b348dea18ed8c4d953183a4b9fd42c5918b71263d6ae8bea6f7305b17f0
-
Filesize
9B
MD577ac50871f710809bbf0957e178463e4
SHA168a9ba0d760af28367efc9773999b978de998a12
SHA25636309483344452798a5953f04265f59efcf323ec5d55ea7f0916449b12d579c1
SHA5123adbde7746af2187e13878b8381313d555ff78f697650a608d38acde761e3bf3827515ea70fb6ea45520d806621565e93c3c8c8e4d2760c463747d1b0a3c8aeb