Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 16:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe
-
Size
1.1MB
-
MD5
4c7576c47be1159e7d67d42228a2ed42
-
SHA1
3f5d4c47e975bcddfbb3cfe78eca9f9418741902
-
SHA256
8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0
-
SHA512
3edbe2e46e781eb2e0161af40d8e0ae4f4ca4eb25677f01358d002417686856186d9b602ac69b1cfb95c600d10807ecd5c73f884bf2da7301cecac1ec4cf294a
-
SSDEEP
24576:t1sXT9T+w6zY8v5a2FZ7WDpk2Kvfd5nP6Wp8zrMBThYBjv:sZ6zY8/7WDaDvfd5iQ8zoBThojv
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3972 Logo1_.exe 1780 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4E6AEEAD-B62E-4CF8-80E5-2A66138AEFDE}\chrome_installer.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe File created C:\Windows\Logo1_.exe 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe 3972 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4572 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 83 PID 2808 wrote to memory of 4572 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 83 PID 2808 wrote to memory of 4572 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 83 PID 4572 wrote to memory of 3940 4572 net.exe 86 PID 4572 wrote to memory of 3940 4572 net.exe 86 PID 4572 wrote to memory of 3940 4572 net.exe 86 PID 2808 wrote to memory of 3860 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 89 PID 2808 wrote to memory of 3860 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 89 PID 2808 wrote to memory of 3860 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 89 PID 2808 wrote to memory of 3972 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 91 PID 2808 wrote to memory of 3972 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 91 PID 2808 wrote to memory of 3972 2808 8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe 91 PID 3972 wrote to memory of 2844 3972 Logo1_.exe 92 PID 3972 wrote to memory of 2844 3972 Logo1_.exe 92 PID 3972 wrote to memory of 2844 3972 Logo1_.exe 92 PID 3860 wrote to memory of 1780 3860 cmd.exe 94 PID 3860 wrote to memory of 1780 3860 cmd.exe 94 PID 2844 wrote to memory of 4996 2844 net.exe 95 PID 2844 wrote to memory of 4996 2844 net.exe 95 PID 2844 wrote to memory of 4996 2844 net.exe 95 PID 3972 wrote to memory of 1512 3972 Logo1_.exe 96 PID 3972 wrote to memory of 1512 3972 Logo1_.exe 96 PID 3972 wrote to memory of 1512 3972 Logo1_.exe 96 PID 1512 wrote to memory of 1316 1512 net.exe 98 PID 1512 wrote to memory of 1316 1512 net.exe 98 PID 1512 wrote to memory of 1316 1512 net.exe 98 PID 3972 wrote to memory of 3380 3972 Logo1_.exe 56 PID 3972 wrote to memory of 3380 3972 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe"C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B58.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe"C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe"4⤵
- Executes dropped EXE
PID:1780
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4996
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1316
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5c9bce56e6c73940b71a024d031d67e29
SHA1c03ffbbc7e3837bc5cbabd2eacccecfff624607c
SHA256c5743ab362bab4eb252577ea5c1fb1bf9dce9a6ec0db29ad2b29acd450c4c44b
SHA51232e59e499a9d7a9c907e638a00f06e69f6ce00c87fec22d1cb0b2b40f5cc9668794cd7eac3fe590b4999f22dd6d927968cf0c21bff1c0af15eac381759a4ca27
-
Filesize
577KB
MD563dbbfc836380251ebca4f61580f1814
SHA16c16254aaeb7f1a86097f6c9220d092730bfe36e
SHA2560cbdf5963d6e01bee0f4db2543b2295b97fc3e8ddf3fda5b38974e56a805fba5
SHA51237033d1c0557af1f07399b4043f7cfd62e27cc5060c91b3179a96fb0c8401de57e566e77c3634d9c18cc41c19131476d359a5adbdb16f1891c6572f96fbb3d24
-
Filesize
722B
MD521c72f247a4c26b3e4c598d786a1dfe0
SHA19fc5b213316fd3888f89693fdd738b3d4479e107
SHA256dcc203e569fa161c5039b26fabb6dbd431e862ee3910dc813b2e9b73d9aedc62
SHA5125e26efc1c0d833f6d944994921147a4db239c7a933995fa2b5f6440324671b9b1796b423419ef764fbd2095d14d8200eff2216731238dcbd289ab22f59a273bc
-
C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe.exe
Filesize1.1MB
MD5f012ebe3b9f0c4d18b43076b68295667
SHA127ce582d305bf5ec574fd7edf39e1300783e9323
SHA256bdff5163ff3787a7a8b6bb3f688e877c5fa10db2ad535bb9765c91e976fbcafe
SHA51206ce3eceb42ca555511f55e85fe79441a4a8c70ad32c36a045560cb8449e44f08bcd9e938e9a11a0360c7363ba2fff4dd92b1a300e21e214a6d273009d8c2463
-
Filesize
33KB
MD5c4440056e06065be031cfa6acd94c763
SHA16c1f366e99fb096685fe30bab2f51d0a41dc7188
SHA256878628fbd3611ca93730e8df7e81fa34165480a71e875cbfc192fb83f97e386e
SHA512e8301dc938a9bc3b2205951171ca38d7c441e425d4d8e1e97ad82fb2b2f519ad4b9774d58b482183a50b769a7a16ec951ea828755c7433b454016b0fae2c86d4
-
Filesize
10B
MD5291aa08828faa68893c7f89a0dfc158b
SHA1fcae3d190f0d8c14b44dc2be0b627b0680d2eab9
SHA256f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841
SHA5129c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38