Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
General
-
Target
ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe
-
Size
5.7MB
-
MD5
72562a6deeb04230d02b78b7d7714b31
-
SHA1
26704770ddb1dd14c5bb1996dc8c896666eb7b1e
-
SHA256
ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944
-
SHA512
11f1e4b39a2d3845aaa2771c464a3c88801f1b052dbf2e1ca51a445b3998059007cb8c7f8b8f3da24bd04b4773deba2cd7e47c92696be9aaa9f8204aa238a693
-
SSDEEP
49152:PKPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:PsKUgTH2M2m9UMpu1QfLczqssnKSk
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2568 Logo1_.exe 1436 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe File created C:\Windows\Logo1_.exe ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe 2568 Logo1_.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 864 wrote to memory of 3896 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 84 PID 864 wrote to memory of 3896 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 84 PID 864 wrote to memory of 3896 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 84 PID 3896 wrote to memory of 1280 3896 net.exe 86 PID 3896 wrote to memory of 1280 3896 net.exe 86 PID 3896 wrote to memory of 1280 3896 net.exe 86 PID 864 wrote to memory of 3292 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 90 PID 864 wrote to memory of 3292 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 90 PID 864 wrote to memory of 3292 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 90 PID 864 wrote to memory of 2568 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 91 PID 864 wrote to memory of 2568 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 91 PID 864 wrote to memory of 2568 864 ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe 91 PID 2568 wrote to memory of 4056 2568 Logo1_.exe 92 PID 2568 wrote to memory of 4056 2568 Logo1_.exe 92 PID 2568 wrote to memory of 4056 2568 Logo1_.exe 92 PID 4056 wrote to memory of 4944 4056 net.exe 94 PID 4056 wrote to memory of 4944 4056 net.exe 94 PID 4056 wrote to memory of 4944 4056 net.exe 94 PID 2568 wrote to memory of 2464 2568 Logo1_.exe 97 PID 2568 wrote to memory of 2464 2568 Logo1_.exe 97 PID 2568 wrote to memory of 2464 2568 Logo1_.exe 97 PID 2464 wrote to memory of 3772 2464 net.exe 99 PID 2464 wrote to memory of 3772 2464 net.exe 99 PID 2464 wrote to memory of 3772 2464 net.exe 99 PID 2568 wrote to memory of 3572 2568 Logo1_.exe 56 PID 2568 wrote to memory of 3572 2568 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe"C:\Users\Admin\AppData\Local\Temp\ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8964.bat3⤵
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe"C:\Users\Admin\AppData\Local\Temp\ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe"4⤵
- Executes dropped EXE
PID:1436
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4944
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3772
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD53c8f68a0cef2c559d338acb7d6cf9f1f
SHA1730598b37c8622552d56a357c90e57badf22eaee
SHA25643e749227f996a83dedfb2f0dc4f1509d659283bf447bbe8dbdaf6a68eff2ef1
SHA512d94d0216f118f386fc068fdb42afc8d243648842ab3c9240c80354538a8a5147564cb3d08b2612ba74c60545d647174782455dc9568c03cced519ffbcb20adcc
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5b683d08031e54ea6942378775fcacdf7
SHA1a2e7e8911ab44ce6e768058d02e2d68a8b093c7d
SHA2567d2c375e7c1e52dfb0254cab9fb3816c5a1ba987b44910dcbbc5f0b3b8294070
SHA51268d53577071249f8e4a5a70713c9b82a295bde488e00cb5c5287ed7c78a5195829eb65c83ddee6f64f6da085d3c0b0723249464044f20088b76aa631dff72599
-
Filesize
722B
MD5962f4f2bf992222d0398224082e590e7
SHA1918a8b549b036ee4e4e4b7147909e22840550726
SHA25656a59d6391a0c93d867183c46f6ca1c007b3975a4a9ae5fa8078646a5367ed3f
SHA5129718d0e7e53b2dc70b7b5a3e784dee068dd2553392b1ee52f0c5d711b440e6f0219b8798cfa0aa30dc68ff5d6c0655be6008ceb4a87eb9342474e87722139419
-
C:\Users\Admin\AppData\Local\Temp\ab700ee3dc7084d094fb2ea891ad9df2416bd78f0edde747661077a98af8f944.exe.exe
Filesize5.7MB
MD5ba18e99b3e17adb5b029eaebc457dd89
SHA1ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA256f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
SHA5121f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
-
Filesize
33KB
MD5733a39683362d1bd636c1385b55be161
SHA180e03d8149fe63a3510e2d7066fd2292506871dd
SHA256c6b4da9d4bec089f9dce9092764e00722417687464ff478e01989bf716959854
SHA51201d907918479b51809c9e45502f17866d902f0f25a4dd2a2bf2ff98c151d4bbabf8e95adc6ff0ecf967d08234555e877117be6b68a04411dff833327d361b1d8
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
10B
MD552a225cec34530c05c340f9ae894aa31
SHA1d6553bc25b5bc40447184e9dd520dd7c88f5c2aa
SHA256bddf98f152ff77575c277b91c8f7aa5f69973cd3bfe7aa55ebe61b7d3df17fab
SHA512726f8a96e3dab9ec548bda81a01dc3e0d93afa2363c76c4bf639de4b0471f8a43a8e32e90b230b95639e82b7daa8da3e8d9c848755e2b58398aa48e46e5ba5b5