0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
Size

29KB
MD5

730b6af32a222642a710fc2413b785ef
SHA1

360a9cc42c446bd1011bc9262da39f3a4332681a
SHA256

0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681
SHA512

3c059ed2e9ed0bee3513ec24bbf2b4f0f1099f9f2c4c2d44e14d02bd8062ec5f1aac49642b8a4c662bb1c697e562c6fde844935fb5501f7db24340bb0c2fa81c
SSDEEP

384:Nbbco1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pQo16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\Z:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\Y:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\U:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\S:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\L:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\J:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\E:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\W:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\Q:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\N:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\M:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\I:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\H:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\T:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\R:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\O:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\K:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\X:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\V:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\G:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 2280	288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	29
PID 288 wrote to memory of 2280	288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	29
PID 288 wrote to memory of 2280	288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	29
PID 288 wrote to memory of 2280	288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	29
PID 2280 wrote to memory of 2776	2280	net.exe	31
PID 2280 wrote to memory of 2776	2280	net.exe	31
PID 2280 wrote to memory of 2776	2280	net.exe	31
PID 2280 wrote to memory of 2776	2280	net.exe	31
PID 288 wrote to memory of 1364	288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	20
PID 288 wrote to memory of 1364	288	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1364
- C:\Users\Admin\AppData\Local\Temp\0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
  "C:\Users\Admin\AppData\Local\Temp\0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
202549f4e2260f7a6f2663d25c5e29bf

SHA1
b77322a55629631fa7f903438b59fa573c107d2e

SHA256
6f12aa3b5d9a9fad447eeadcdae602df33146d86ee3c2bd5c6a1b1671d9e3dec

SHA512
00747844a004d8b8fde1cca2dc58df266dd582da33c3ec4bb2b108ce0709b319878e863cbc3fd9fdc442a996809c57b3b45f31952dce02424c0c46c44f47e101

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
a1783bfe3e9a32eb97163d475729ea64

SHA1
a9df7602fdf0dc3ebc49e7a36c402e6c385d47f5

SHA256
c07cd0f95cdae61d667a69451ff93aada8480023b579f81dfe0e0ab154e1b7c2

SHA512
ec114e17d01d92e7c8209963097003689901fb7fe313f236fef373571351066452b37c10e6f0c1496ad081402af87bbbc8fe5d5737fd3665c73d9d839312ce44

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
1ca79e3c2539763b0aaac5de49795afe

SHA1
2d240aef9a2cce22578f42ebecd3058e37a404a8

SHA256
e3e49eceb810b34fc826d70c6556d927a363f29c90b347ee4cfd61d7ba3ff2d9

SHA512
4e24d3ebcefa6545d85517bbc5bff3285f85a5967da1642a6e4e53bc2c41efc8b9092a3bbb56c1670b215d623ff5c320bcb06f654ac97482a5dff0da208349e6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\_desktop.ini

Filesize
10B

MD5
291aa08828faa68893c7f89a0dfc158b

SHA1
fcae3d190f0d8c14b44dc2be0b627b0680d2eab9

SHA256
f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841

SHA512
9c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38

Download Submit
memory/288-67-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-21-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-74-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-104-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-1851-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/288-3311-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1364-5-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download