Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe
-
Size
47KB
-
MD5
c1e2cd8de32de2d44441bbe1988f0af3
-
SHA1
daff69b74f2814bb4db2ca791992cddb11c4dd76
-
SHA256
a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85
-
SHA512
04effc1bd4467fafb6167253d6f9f9fab3a6cda1e0aa3f2c3c173b3745c9d33438edbb2e559bca13fb8169faa75d7f6bce91cf4cf893d967421830389d6a7535
-
SSDEEP
768:IvO5RroZJ767395uINnEfDKBbUCp1OTZ+/VJWQ3655Kv1X/qY1MSd:Ive+Zk77RNzLiTOJHqaNrFd
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2868 Logo1_.exe 4968 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe File created C:\Windows\Logo1_.exe a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe 2868 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2560 wrote to memory of 4504 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 83 PID 2560 wrote to memory of 4504 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 83 PID 2560 wrote to memory of 4504 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 83 PID 4504 wrote to memory of 2544 4504 net.exe 85 PID 4504 wrote to memory of 2544 4504 net.exe 85 PID 4504 wrote to memory of 2544 4504 net.exe 85 PID 2560 wrote to memory of 4284 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 89 PID 2560 wrote to memory of 4284 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 89 PID 2560 wrote to memory of 4284 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 89 PID 2560 wrote to memory of 2868 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 90 PID 2560 wrote to memory of 2868 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 90 PID 2560 wrote to memory of 2868 2560 a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe 90 PID 4284 wrote to memory of 4968 4284 cmd.exe 92 PID 4284 wrote to memory of 4968 4284 cmd.exe 92 PID 4284 wrote to memory of 4968 4284 cmd.exe 92 PID 2868 wrote to memory of 5020 2868 Logo1_.exe 93 PID 2868 wrote to memory of 5020 2868 Logo1_.exe 93 PID 2868 wrote to memory of 5020 2868 Logo1_.exe 93 PID 5020 wrote to memory of 3344 5020 net.exe 95 PID 5020 wrote to memory of 3344 5020 net.exe 95 PID 5020 wrote to memory of 3344 5020 net.exe 95 PID 2868 wrote to memory of 4896 2868 Logo1_.exe 96 PID 2868 wrote to memory of 4896 2868 Logo1_.exe 96 PID 2868 wrote to memory of 4896 2868 Logo1_.exe 96 PID 4896 wrote to memory of 3656 4896 net.exe 98 PID 4896 wrote to memory of 3656 4896 net.exe 98 PID 4896 wrote to memory of 3656 4896 net.exe 98 PID 2868 wrote to memory of 3444 2868 Logo1_.exe 56 PID 2868 wrote to memory of 3444 2868 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe"C:\Users\Admin\AppData\Local\Temp\a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a974E.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe"C:\Users\Admin\AppData\Local\Temp\a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3344
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3656
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD56d352348fdfd69c04b66abc3216c61b7
SHA12ccfc99572573ea8b3e941d2d0ba21150c5f7230
SHA256830d0c74334a2d6a589bbd4761e210d71e8dd376acd96a4030baae51a2c24fe2
SHA51206cd378b1517dbd0009abf87b517fdab0e2f0c5f47b661081ecabca4bcc6feb29837bdbdd678ae9fff08f28821fc280c82d5848e0572996b6bf116a0bc1bf231
-
Filesize
577KB
MD53a172058fe34b8071a886f7201dd1c45
SHA122454cce666f13da497a1e66358ff3d1c0a96336
SHA25615db6b8b789fee46fb8274b90216d225d0a294e5ecacb095ddc812efd22f399f
SHA512ef3d6e0b4fe42ec1607ca37380ac850392e1ed6e72c52ecb3214597ba9f03b823112e16a1664d85c02216ecc33940bf53eec8c0b96bdf3337349e8006b2c35f1
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5e0725f04ef2eb236cf23dbdc14d512a5
SHA1ef9875c8bd15d6c9cdcb0a4025470fae9e0d00b2
SHA256ca3e9560c3c22fbb4efc142647d6918fe315dda96b5e00c9f0431f55ca97bcaa
SHA5122dacc3b71e320017826ef563affec0c895cdda9cd293b6814df20aefa5d936e6fbed1d387f9224e533f473243ecb6ea5865d0919f56459c6c3e014e07d241a4e
-
Filesize
722B
MD5b7eddd37c5ebaa8282893dd68bdfcbef
SHA16c32c51a7b25785dd54185ed1b27bb6842d48cb7
SHA256d668298bd9fd76ea4873b2b5352f3d5c085b26a4cd36fb0275601916ab162692
SHA5127a18148aa653da2951d2560fd040ebb98afb5928f2beddda6b5355eef26057d53d410f5e92e2ed798cda7152303cabf6beb14364ae5dd1fed689a7a97909367b
-
C:\Users\Admin\AppData\Local\Temp\a841fc014c00eec9c2d2f58d561a53549f95e7319346e9925c1f58ea23c6be85.exe.exe
Filesize14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
Filesize
33KB
MD507fea4ec486b99416c9b588285c81d06
SHA1842a874a212fc1b58ead782251f286babc151ada
SHA256d1ad05b9d8babf31e05639334f120109d33242866009209ecf68397b71f9e4a7
SHA51264ce4e97be8b1afea9def07b2970470e23b812fa81884fd2d3f2f1ee29699bbff4e9025804e49d2404299c2a690942f50620d5c03f84c0afa538069af73ca355
-
Filesize
10B
MD5291aa08828faa68893c7f89a0dfc158b
SHA1fcae3d190f0d8c14b44dc2be0b627b0680d2eab9
SHA256f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841
SHA5129c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38