22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
Size

27KB
MD5

ec7ef612228019e1953b6359806b7ee9
SHA1

f32b6540896e44388bd223837a3c042ce652ebbd
SHA256

22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16
SHA512

930cb248bde09bb5533484966a2bd1b10322db13288ea68ac9c17653d3b8c843d15daf6e8eb9ce930d1086a332f263f170295b6c8a96004621a5d94fe7f8ab37
SSDEEP

384:MS8D1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:KD16GVRu1yK9fMFLKaTxsujCT7pZpY

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\Q:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\K:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\J:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\U:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\T:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\R:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\E:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\Y:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\P:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\L:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\Z:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\X:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\W:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\V:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\O:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\N:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\M:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\I:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\H:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened (read-only)	\??\G:	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\View3d\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1036	1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe	83
PID 1768 wrote to memory of 1036	1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe	83
PID 1768 wrote to memory of 1036	1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe	83
PID 1036 wrote to memory of 3596	1036	net.exe	86
PID 1036 wrote to memory of 3596	1036	net.exe	86
PID 1036 wrote to memory of 3596	1036	net.exe	86
PID 1768 wrote to memory of 3564	1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe	56
PID 1768 wrote to memory of 3564	1768	22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3564
- C:\Users\Admin\AppData\Local\Temp\22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe
  "C:\Users\Admin\AppData\Local\Temp\22f08dd11d2dc63f24de7fbebac3bcdcaac9a99ae4bf9629660a40cf81ed4f16.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
170KB

MD5
f49f03760b60eea9bf77edf279f6c2a8

SHA1
8ed230e5ed2359d28b23493aa53547b212b0f4f0

SHA256
73a771064beec49df67d7f0d2000958a7589f3b7f6f3f87ea246cafa63ae94af

SHA512
48ba5149a1e383566439119208f242cf69013e614cea1f93261dba4c389934ac6dbb524972798578a59613957704c1c415f8c90224babbd6f2bfb7c248b26c58

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
637KB

MD5
9cba1e86016b20490fff38fb45ff4963

SHA1
378720d36869d50d06e9ffeef87488fbc2a8c8f7

SHA256
a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19

SHA512
2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\_desktop.ini

Filesize
10B

MD5
291aa08828faa68893c7f89a0dfc158b

SHA1
fcae3d190f0d8c14b44dc2be0b627b0680d2eab9

SHA256
f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841

SHA512
9c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38

Download Submit
memory/1768-22-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-18-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-1219-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-4770-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-5243-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download