0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681

Analysis

max time kernel
149s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
Size

29KB
MD5

730b6af32a222642a710fc2413b785ef
SHA1

360a9cc42c446bd1011bc9262da39f3a4332681a
SHA256

0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681
SHA512

3c059ed2e9ed0bee3513ec24bbf2b4f0f1099f9f2c4c2d44e14d02bd8062ec5f1aac49642b8a4c662bb1c697e562c6fde844935fb5501f7db24340bb0c2fa81c
SSDEEP

384:Nbbco1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pQo16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\O:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\M:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\T:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\U:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\S:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\R:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\N:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\H:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\G:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\Y:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\J:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\W:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\X:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\V:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\P:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\L:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\K:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\I:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\E:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened (read-only)	\??\Z:	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fil-PH\View3d\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\jsaddins\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\VideoLAN\VLC\skins\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 756	4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	83
PID 4464 wrote to memory of 756	4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	83
PID 4464 wrote to memory of 756	4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	83
PID 756 wrote to memory of 1892	756	net.exe	85
PID 756 wrote to memory of 1892	756	net.exe	85
PID 756 wrote to memory of 1892	756	net.exe	85
PID 4464 wrote to memory of 3504	4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	56
PID 4464 wrote to memory of 3504	4464	0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3504
- C:\Users\Admin\AppData\Local\Temp\0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe
  "C:\Users\Admin\AppData\Local\Temp\0cdc112290f0f4d9c44254c64ebf1d74abc2fdb7a8c79bf2923ced5eabc08681.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
247KB

MD5
a86ebe0c21ff89f95643bba336b7a4ce

SHA1
8bcd964ee8e70c020a9ccf21867b0cc654e0d8e2

SHA256
25298c5f32082b982fbec5a24f83ae61d76cf625bcaa26696f893215782edb5e

SHA512
fe20cf341eb25847f67e2ad69de8b335a951d73800c98dac0aaa70fc76b8bf34722aa92f7c3f32305ac7514c80f88d1f503d94a246ea0750438b434f399f383a

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
173KB

MD5
69d379668a63bf68433f93d5014b7067

SHA1
0ae20a1e0374719e6a1b2818706a7649e49dc531

SHA256
97193948c8be21aeed6ee7cf888779e049c6b45c7f6903a001b4058941531c9d

SHA512
054e7fae362e47ed7a7230ab3b56f4afa00b2ac194e4ef21f35530af37446ca891e859618e25304adc22ef07c9c05080c877e0355871d5c97bcfe37353dc88ba

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
8e20cd4ac13828acae9e458cea8e8c56

SHA1
794cb8e8b5519214c4d4c89e9d5ff0967e224d72

SHA256
ed2019032918ac1a2a246a501166a13f7f2bda2f2ca354ad2db584c41c774e5c

SHA512
e5e6d2147fb76a7c11e738fbfacbe0b189862cdb35b7de75c82b4ed5784b90953cfda3d1052fceecf3f76a9f873b7ed052c70a4847669b7657bfce522ff907d4

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\_desktop.ini

Filesize
10B

MD5
291aa08828faa68893c7f89a0dfc158b

SHA1
fcae3d190f0d8c14b44dc2be0b627b0680d2eab9

SHA256
f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841

SHA512
9c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38

Download Submit
memory/4464-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-556-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-1219-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-4770-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-5239-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download