Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 15:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe
-
Size
264KB
-
MD5
59c0a090709b272a3d13597e24366edf
-
SHA1
f118be31b546bb591fb245a9e3f0b6ec05f6cbc7
-
SHA256
0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028
-
SHA512
8e7c583d568a9ea0d70ca96b47a75fedbad4a539e001046ff8733521d9e25cd3820b9e5a4ad19a3b69bd78f73d146a9c4442e29b81152be14f0cde43a2aba1eb
-
SSDEEP
3072:Hx9AaY46tGNttyCa6jLRkgUA1nQZwFGVO4Mqg+WDY:3Q46tGdyr6jLRp1nQ4QLd
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4468 Logo1_.exe 3020 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe File created C:\Windows\Logo1_.exe 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe 4468 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 5076 wrote to memory of 4496 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 83 PID 5076 wrote to memory of 4496 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 83 PID 5076 wrote to memory of 4496 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 83 PID 4496 wrote to memory of 4180 4496 net.exe 86 PID 4496 wrote to memory of 4180 4496 net.exe 86 PID 4496 wrote to memory of 4180 4496 net.exe 86 PID 5076 wrote to memory of 4272 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 89 PID 5076 wrote to memory of 4272 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 89 PID 5076 wrote to memory of 4272 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 89 PID 5076 wrote to memory of 4468 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 90 PID 5076 wrote to memory of 4468 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 90 PID 5076 wrote to memory of 4468 5076 0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe 90 PID 4468 wrote to memory of 2016 4468 Logo1_.exe 92 PID 4468 wrote to memory of 2016 4468 Logo1_.exe 92 PID 4468 wrote to memory of 2016 4468 Logo1_.exe 92 PID 2016 wrote to memory of 1936 2016 net.exe 94 PID 2016 wrote to memory of 1936 2016 net.exe 94 PID 2016 wrote to memory of 1936 2016 net.exe 94 PID 4272 wrote to memory of 3020 4272 cmd.exe 95 PID 4272 wrote to memory of 3020 4272 cmd.exe 95 PID 4272 wrote to memory of 3020 4272 cmd.exe 95 PID 4468 wrote to memory of 2196 4468 Logo1_.exe 96 PID 4468 wrote to memory of 2196 4468 Logo1_.exe 96 PID 4468 wrote to memory of 2196 4468 Logo1_.exe 96 PID 2196 wrote to memory of 2300 2196 net.exe 98 PID 2196 wrote to memory of 2300 2196 net.exe 98 PID 2196 wrote to memory of 2300 2196 net.exe 98 PID 4468 wrote to memory of 3380 4468 Logo1_.exe 56 PID 4468 wrote to memory of 3380 4468 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe"C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a807A.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe"C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1936
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5ed3402e9b15a3bbd9524371c86059497
SHA11985cc1f9c4c202bc3b999b2d5f807be3468ea84
SHA25613da562fee9cb7ff7ed75fcd22b9912ce9bfcac0c072be077f54c714fb987d75
SHA512b6c61dba5e0b422e5442147fb6bca1a920f2db3b75f3c800baf442df6009640c233b49a16177cfb3dd29ecbb3224b652e289001ba2bddb67a5bad7e94b6c3d19
-
Filesize
577KB
MD54e5252171e6c7bdb2181267865d20ba5
SHA11115a4f4dcee557cdca971b5a9c801eed01e629a
SHA256a2d88af1a630da600580ab6bc6d4ea18d2c44cc9254dfdf945d95534577354a2
SHA5124ed54ef6cf2bc08250c16ba1c842ad3e3bfe84815dc5712dfd63aa8ba358f163147a73823e14148de59c15c224e9aee39b969a7d089e46603c739405924d537b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5068a33bb477e4ec6dbcbde7e8ddca6eb
SHA1e570f512d736f0d78b2c9d9ed6e0dc9d5f82b4e4
SHA256d0f6ee3e4f6d04526d7e29cf0d393844a9942a2341d7f37c7824ed220d21d7d8
SHA51250d4b143a42bb7b655b8a3d923ce959521a59c69a2a6a8deab5d11f9a15ea27baad1eb4eea7d16c5516fbce1b7d3cce22159f060326266c6c6c5ffe14c902406
-
Filesize
722B
MD576423e6e93d638799460edf9ccfeef30
SHA1ef016805ea53fb73c0b41b5023fe9d5b0922fa12
SHA256a014785511346461aec3ef081282677b9fe16ff3b03ddd6dc09ba5f44756f81e
SHA5121c43cf0fec5f2019498e45f8aff7cc777febe41614df8cb8ed2fb6181d2f6a0c39c7a657f88b82031e614b33cb58053f31098a442237ed9af00ce9b507d2ea2e
-
C:\Users\Admin\AppData\Local\Temp\0f1998fd0b1d62cb0fb1309bfd786d3cdc21a8dfdee8b229db3ae4c9a511d028.exe.exe
Filesize231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
Filesize
33KB
MD5f592a695c614a35428ee6c9de88f2211
SHA184f32c4c5cc64ba34a66f3fccaabe4dbe295bdcc
SHA256d1592ab1059b17898a5b0fb193a1e1e1cad6edf57e5190c5ad2cf99c8830e85b
SHA512c1ce2431e3812cd57f65bc8f79a5025395f76bcdc7f98bd3744ece29300bf10e008198365de9b7a326f0b9202130ea8c4df7e07cf8cc66d845d48892f1666f15
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
10B
MD51603436fb34d76c51d66ab1816519131
SHA13d5dc4ccfe3cc992c253dccfccf66ea727f66bf6
SHA2569072a674ab684ff3ef851bf4f0fdc4118d2bcbe765282f38f3f6de4360057d60
SHA51230d89b59822313e4b281b8f63b959f36262b2b948cf38e6389e9a1a7517c7c239349a41de9e35c8cd27d6b852ab5349206c2fb85b631dc59fab5421d997dbd46