Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe
-
Size
5.7MB
-
MD5
108354968607f1d8f878b594abe4d7bb
-
SHA1
79c19e3cfed2ce36b098028bae5db8c0badea1e5
-
SHA256
4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a
-
SHA512
92ab8a67b87c62970891c4942e926f92163e3cc3390afea55cc4ebb4bd557333764430561c977cfb167e1675382c75cc34c8a4233e8d7ee93f3aaeb3f5aa5002
-
SSDEEP
49152:0d+Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTP:0dAKUgTH2M2m9UMpu1QfLczqssnKSk
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1868 Logo1_.exe 100 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe File created C:\Windows\Logo1_.exe 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe 1868 Logo1_.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2280 wrote to memory of 3420 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 85 PID 2280 wrote to memory of 3420 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 85 PID 2280 wrote to memory of 3420 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 85 PID 3420 wrote to memory of 3028 3420 net.exe 87 PID 3420 wrote to memory of 3028 3420 net.exe 87 PID 3420 wrote to memory of 3028 3420 net.exe 87 PID 2280 wrote to memory of 2932 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 89 PID 2280 wrote to memory of 2932 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 89 PID 2280 wrote to memory of 2932 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 89 PID 2280 wrote to memory of 1868 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 91 PID 2280 wrote to memory of 1868 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 91 PID 2280 wrote to memory of 1868 2280 4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe 91 PID 1868 wrote to memory of 1388 1868 Logo1_.exe 92 PID 1868 wrote to memory of 1388 1868 Logo1_.exe 92 PID 1868 wrote to memory of 1388 1868 Logo1_.exe 92 PID 1388 wrote to memory of 4972 1388 net.exe 94 PID 1388 wrote to memory of 4972 1388 net.exe 94 PID 1388 wrote to memory of 4972 1388 net.exe 94 PID 1868 wrote to memory of 880 1868 Logo1_.exe 96 PID 1868 wrote to memory of 880 1868 Logo1_.exe 96 PID 1868 wrote to memory of 880 1868 Logo1_.exe 96 PID 880 wrote to memory of 2012 880 net.exe 98 PID 880 wrote to memory of 2012 880 net.exe 98 PID 880 wrote to memory of 2012 880 net.exe 98 PID 1868 wrote to memory of 3396 1868 Logo1_.exe 56 PID 1868 wrote to memory of 3396 1868 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe"C:\Users\Admin\AppData\Local\Temp\4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC2E.bat3⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe"C:\Users\Admin\AppData\Local\Temp\4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe"4⤵
- Executes dropped EXE
PID:100
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2012
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD52bafcbc645c521efd779667bf4140ad7
SHA173740e7d221009e3868d70854bf41bc0db9c2afb
SHA256c6f3de917dc0a454020fa770737ff62405f8e0e2b543bc167573e9b9e54b03c5
SHA51227f29a11c18c7c84ad52858df7eca4d6f96a11b47f7176cad00b3832e164b5bf68fc2e0283ad0a3339e8d6b821cd75507603f546148c4b54f58827a0aaf11ac1
-
Filesize
577KB
MD550327f431f57192ca3e24dce51664269
SHA170fd6cdc8182d3c748a7802c4b5f51502abfb5f9
SHA256cf6d2c89c49002f8a4bb81d3cdebca46147fd1da6c333f082e18b59ad3617b97
SHA5122e43f158f98e7a5e7f32e6819e5300c6b32990ecbaf83bf0ebc43aa1f4671ede81d6bc3bec960495c3cd68e08e419989998ecaf58cd28c6096a5d557c4b6f88b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD551c1eb02821359551eae62ff451ccbb4
SHA1917e11eb8a26a033a330a9cee5c5207d0da1109a
SHA2569afbb3fd781ea931d8bc856c768fe7af7e440e9f7a29950b5dca44593f0ef04f
SHA512062f0c32d3d9b46fc670512a818c88919bcc90a2f7f5bd4910f917a96c42527fd6c28117c366cb66cd6bfa3ec64f5a43aadcaa4bdad01c8d45eb2bfe2c85f5ee
-
Filesize
722B
MD50533de18d3ea9715c0e5bd9eac62da5a
SHA12f5a0b8440b2c505d31b6f1ee4f87a302aecc2ae
SHA2560cf78f0ec568d7f1ffb94bd3f955ce8f355017d15af45f7eb3f81fb76bd1ddee
SHA51218cadccececdf9591ad96f4a22999388c84e030732d0e8859433ebef23550e7249c2f43e718f0bf7fbce1747623b83b3f548b8e39e07e9ab109d5e906c6947a3
-
C:\Users\Admin\AppData\Local\Temp\4b8c8aaf2d17a444f7707531c8b8db95a8461a5037234790a69ddde1f0d3777a.exe.exe
Filesize5.7MB
MD5ba18e99b3e17adb5b029eaebc457dd89
SHA1ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA256f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
SHA5121f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
-
Filesize
33KB
MD565bbec40a1c4b9caa523d3345ac1efa5
SHA1e85a3a25937012de9e98851ed276bcdbc2e3fe70
SHA256600b168b19247d3dd4a472399a6187a1e22f838e863d357617541b9a5b066ec3
SHA512de036926bdfcc46e2847ec17764548d95ca56dfe8355da45cdef785069b82427ad41b51ce7589ce8a52c1d6a1bb418fa31e72feb4c5ee12916d32b224c94cffe
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
10B
MD5dce9bef24921d1fb94c029be04b911db
SHA1d5ff43d520d5df3ee58c947db0b2ac3a039667b6
SHA256c09fceb912fc9cf0f284d9d24ab0029af67d3a3bf08b81d9c0d8a7681b82c157
SHA512cefdb984819b6b058b8d7747c2a9a74c94f6acf2728e884520154f2ffe42776f19b5a5b22b43b61acbb679acefb8489318c7be92e360a3b239ffaae445d6d97b