0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
Size

264KB
MD5

59c0a090709b272a3d13597e24366edf
SHA1

f118be31b546bb591fb245a9e3f0b6ec05f6cbc7
SHA256

0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028
SHA512

8e7c583d568a9ea0d70ca96b47a75fedbad4a539e001046ff8733521d9e25cd3820b9e5a4ad19a3b69bd78f73d146a9c4442e29b81152be14f0cde43a2aba1eb
SSDEEP

3072:Hx9AaY46tGNttyCa6jLRkgUA1nQZwFGVO4Mqg+WDY:3Q46tGdyr6jLRp1nQ4QLd

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2180	Logo1_.exe
3056	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe

Loads dropped DLL 1 IoCs

pid	Process
2804	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Filters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
File created	C:\Windows\Logo1_.exe	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe
2180	Logo1_.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2216	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	31
PID 3052 wrote to memory of 2216	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	31
PID 3052 wrote to memory of 2216	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	31
PID 3052 wrote to memory of 2216	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	31
PID 2216 wrote to memory of 1460	2216	net.exe	33
PID 2216 wrote to memory of 1460	2216	net.exe	33
PID 2216 wrote to memory of 1460	2216	net.exe	33
PID 2216 wrote to memory of 1460	2216	net.exe	33
PID 3052 wrote to memory of 2804	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	34
PID 3052 wrote to memory of 2804	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	34
PID 3052 wrote to memory of 2804	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	34
PID 3052 wrote to memory of 2804	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	34
PID 3052 wrote to memory of 2180	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	36
PID 3052 wrote to memory of 2180	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	36
PID 3052 wrote to memory of 2180	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	36
PID 3052 wrote to memory of 2180	3052	0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe	36
PID 2180 wrote to memory of 2760	2180	Logo1_.exe	37
PID 2180 wrote to memory of 2760	2180	Logo1_.exe	37
PID 2180 wrote to memory of 2760	2180	Logo1_.exe	37
PID 2180 wrote to memory of 2760	2180	Logo1_.exe	37
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2804 wrote to memory of 3056	2804	cmd.exe	39
PID 2760 wrote to memory of 2768	2760	net.exe	40
PID 2760 wrote to memory of 2768	2760	net.exe	40
PID 2760 wrote to memory of 2768	2760	net.exe	40
PID 2760 wrote to memory of 2768	2760	net.exe	40
PID 2180 wrote to memory of 2636	2180	Logo1_.exe	41
PID 2180 wrote to memory of 2636	2180	Logo1_.exe	41
PID 2180 wrote to memory of 2636	2180	Logo1_.exe	41
PID 2180 wrote to memory of 2636	2180	Logo1_.exe	41
PID 2636 wrote to memory of 2968	2636	net.exe	43
PID 2636 wrote to memory of 2968	2636	net.exe	43
PID 2636 wrote to memory of 2968	2636	net.exe	43
PID 2636 wrote to memory of 2968	2636	net.exe	43
PID 2180 wrote to memory of 1248	2180	Logo1_.exe	21
PID 2180 wrote to memory of 1248	2180	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1248
- C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
  "C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aD49D.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
      "C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3056
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
953b14909436255cf8b577cdb4d8847c

SHA1
fd7490804997808f2f66966c9cdc47178306e824

SHA256
b0bb88aa0ed41f4eeeb6dcc089a6bbfc5a86cfd06a14baf6f5faf7f1423a00f0

SHA512
cf42958cf6570d17ecf0f7268860174bad40048c84b366b2b708778046bf5d11822e399258c47b41336533d5582aa549301b742c59647fa33a341a038f3bad57

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
351e71807210e37c4767fb10f08e8e94

SHA1
4209f9b8e9570e5fd6c50d742c7833fffa83c70b

SHA256
3ba4929aaf7cd407db10183d2ef6330cb842144a18613ec33003427de41e5383

SHA512
97fee72f9bb10d482a4ca1098053527b6b7707c8be869a18bb5ad35abd037663f7b834724ef3e61cd950843cba085a5b9a34cee3662d1cbf49df4d0dac91a1b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aD49D.bat

Filesize
722B

MD5
98dbb92d76335afb25953fbaaa30aca0

SHA1
a7d89f0db9e8524278b524b2cd55279ab3fcf65b

SHA256
9edda7e40b7807a17d1aae6fa8f695488de96b86e56956ae7973ca4b4f97301d

SHA512
8cf77dc85c654e4be76cba722079cc334bfc231820bd2f63394f03cc3b72a6830c2500bb6f94b590248452d08dce5aedab12739d3b328f18a6ed07cdd908d63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe.exe

Filesize
231KB

MD5
6f581a41167d2d484fcba20e6fc3c39a

SHA1
d48de48d24101b9baaa24f674066577e38e6b75c

SHA256
3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7

SHA512
e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
f592a695c614a35428ee6c9de88f2211

SHA1
84f32c4c5cc64ba34a66f3fccaabe4dbe295bdcc

SHA256
d1592ab1059b17898a5b0fb193a1e1e1cad6edf57e5190c5ad2cf99c8830e85b

SHA512
c1ce2431e3812cd57f65bc8f79a5025395f76bcdc7f98bd3744ece29300bf10e008198365de9b7a326f0b9202130ea8c4df7e07cf8cc66d845d48892f1666f15

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
832B

MD5
7e3a0edd0c6cd8316f4b6c159d5167a1

SHA1
753428b4736ffb2c9e3eb50f89255b212768c55a

SHA256
1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

SHA512
9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\_desktop.ini

Filesize
10B

MD5
1603436fb34d76c51d66ab1816519131

SHA1
3d5dc4ccfe3cc992c253dccfccf66ea727f66bf6

SHA256
9072a674ab684ff3ef851bf4f0fdc4118d2bcbe765282f38f3f6de4360057d60

SHA512
30d89b59822313e4b281b8f63b959f36262b2b948cf38e6389e9a1a7517c7c239349a41de9e35c8cd27d6b852ab5349206c2fb85b631dc59fab5421d997dbd46

Download Submit
memory/1248-31-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/2180-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2180-21-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2180-2879-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2180-4159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-18-0x0000000001CA0000-0x0000000001CDE000-memory.dmp

Filesize
248KB

Download
memory/3052-17-0x0000000001CA0000-0x0000000001CDE000-memory.dmp

Filesize
248KB

Download
memory/3052-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download