Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
-
Size
264KB
-
MD5
4ab45cfb9b6521024b3829a53017c2d2
-
SHA1
590a9bc930de81b2a2b5577f2e1162be6f0c4920
-
SHA256
4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c
-
SHA512
f461363ec46ab62e488dc37a1982c028afc51ee5a855d2d7f7f8c0959619e2e418b426721e6e4c158b39366cb2f44c567a69e4b5bfe781b5a9a77a83a88e2c28
-
SSDEEP
3072:2CaY46tGNttyeQLYm1LLRkgUA1nQZwFGVO4Mqg+WDY:h46tGdye41LLRp1nQ4QLd
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1528 Logo1_.exe 2800 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe File created C:\Windows\Logo1_.exe 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe 1528 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3284 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 84 PID 5088 wrote to memory of 3284 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 84 PID 5088 wrote to memory of 3284 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 84 PID 3284 wrote to memory of 4832 3284 net.exe 86 PID 3284 wrote to memory of 4832 3284 net.exe 86 PID 3284 wrote to memory of 4832 3284 net.exe 86 PID 5088 wrote to memory of 1816 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 89 PID 5088 wrote to memory of 1816 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 89 PID 5088 wrote to memory of 1816 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 89 PID 5088 wrote to memory of 1528 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 90 PID 5088 wrote to memory of 1528 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 90 PID 5088 wrote to memory of 1528 5088 4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe 90 PID 1528 wrote to memory of 2740 1528 Logo1_.exe 92 PID 1528 wrote to memory of 2740 1528 Logo1_.exe 92 PID 1528 wrote to memory of 2740 1528 Logo1_.exe 92 PID 2740 wrote to memory of 4936 2740 net.exe 94 PID 2740 wrote to memory of 4936 2740 net.exe 94 PID 2740 wrote to memory of 4936 2740 net.exe 94 PID 1816 wrote to memory of 2800 1816 cmd.exe 95 PID 1816 wrote to memory of 2800 1816 cmd.exe 95 PID 1816 wrote to memory of 2800 1816 cmd.exe 95 PID 1528 wrote to memory of 3364 1528 Logo1_.exe 96 PID 1528 wrote to memory of 3364 1528 Logo1_.exe 96 PID 1528 wrote to memory of 3364 1528 Logo1_.exe 96 PID 3364 wrote to memory of 2568 3364 net.exe 98 PID 3364 wrote to memory of 2568 3364 net.exe 98 PID 3364 wrote to memory of 2568 3364 net.exe 98 PID 1528 wrote to memory of 3504 1528 Logo1_.exe 56 PID 1528 wrote to memory of 3504 1528 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe"C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7196.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe"C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4936
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5712d1e8ff36d128a500dd2ca03f4366d
SHA14d97940b84b69b44fd90705723534dd90bb51083
SHA25622c5c03331c868888af212d1698d1f5f6b5c0d71f7bc8f1b2e8f1775e519e635
SHA512ada0f660f4c593d48a592601774b8f8562e8fd1886d7b27f0db23f5aef5c31363b52598d4755d881863d553a08da8f0ab750d00569120f4c8891f8d118ac1a84
-
Filesize
577KB
MD5c20f761fcf118d3856ccedeeaa8f7522
SHA199119635ff856ed9cd80c5d8972908b9495a4cb4
SHA256df7c4a56c6a097085284a91a043102a9c4ff8a7b071af13618c084c51665a21c
SHA512fc9cd7090ffdd7cff4e50c0cad7ac17d6c28a4ddbcacb76f6fe51da67dc590005ee672514b7087a5783ab997fea615a0c02f423186aad62b7002b9948d035eaf
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5e3789f43def2321f01c16b6e18bba5ff
SHA14911c2ef35ff8ef5b9c5a5ec69f4394a08f87492
SHA2563443421d39fe1ff808589873d0a95e0258a738cddc3015f6b42aa9b68fedbaf4
SHA512132ed6a72034454bb97a0290a5289c10c990eb2f2be9db8d93816db25a2d7e19e164ff7f0b35ad190a891af0852ce4613d2c01db7ac2f2bf34cfb59f8c3dc6ed
-
Filesize
722B
MD5cb832284cc2805de0a4f60ed51240fbf
SHA12657cdd32f9f123661c608f143dff8a28207f8fb
SHA25650192d3767d6e17787f2064936eb4824eb4242f6adaeb00d525e67ee1900bc78
SHA512beaa89002ec8ddb1115b8a1ab51af331eae2d1c8da391992a081192912591b8abaf47f5d39c10b6f50ffc85134ed7b130c4d6a71a715def33a9b97d773d046dc
-
C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe.exe
Filesize231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
Filesize
33KB
MD5da194ed032e8c4c99f906abd0b52e279
SHA177b06c04e207481522179ea7ac71c7ebdc80b70e
SHA256b06e9af9027c0f9b6929c97f21192d88b44fc4e0be72db6db918398eb8ea183b
SHA51202a6b836e8f8221d994fcad3f05bec20ea32029cbd56946670414b0fd3b4d391c6ccf455f2c18fc6a5e0d0d4174cc402cabe3ea8109e7bca27e9e728aea43f1a
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
10B
MD51603436fb34d76c51d66ab1816519131
SHA13d5dc4ccfe3cc992c253dccfccf66ea727f66bf6
SHA2569072a674ab684ff3ef851bf4f0fdc4118d2bcbe765282f38f3f6de4360057d60
SHA51230d89b59822313e4b281b8f63b959f36262b2b948cf38e6389e9a1a7517c7c239349a41de9e35c8cd27d6b852ab5349206c2fb85b631dc59fab5421d997dbd46