Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe
Resource
win7-20240903-en
General
-
Target
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe
-
Size
33KB
-
MD5
acea89f403bcb47ee1d946bcda6fd439
-
SHA1
a919c58021cec518e83830e534b687c2063fdba3
-
SHA256
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf
-
SHA512
eb629979a847d4107088dc15c1fe0ca34b87f76de8e30bc4b2ec167604fc200fe78d235e1a3f940861428f3c8d325fb1dc82ed424238dac8f2b8cb7ed33ca6e1
-
SSDEEP
384:CbbBSGIAF+GPO5RQ0JvoNcAJAS6X4S39AaxIINU716CYlC5nQLiX/zrnFOlVCFlI:mxt5PO5RroZJ767395uINUh5dIInc
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\L: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\S: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\Q: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\P: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\I: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\U: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\R: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\J: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\W: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\V: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\N: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\M: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\K: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\Z: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\Y: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\X: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\H: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\T: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\G: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\E: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Sidebar\en-US\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\ja-JP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Media Player\fr-FR\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Microsoft Office\Office14\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Media Player\Icons\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Windows\Dll.dll 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1640 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 30 PID 2420 wrote to memory of 1640 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 30 PID 2420 wrote to memory of 1640 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 30 PID 2420 wrote to memory of 1640 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 30 PID 1640 wrote to memory of 1716 1640 net.exe 32 PID 1640 wrote to memory of 1716 1640 net.exe 32 PID 1640 wrote to memory of 1716 1640 net.exe 32 PID 1640 wrote to memory of 1716 1640 net.exe 32 PID 2420 wrote to memory of 2352 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 33 PID 2420 wrote to memory of 2352 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 33 PID 2420 wrote to memory of 2352 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 33 PID 2420 wrote to memory of 2352 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 33 PID 2352 wrote to memory of 2284 2352 net.exe 35 PID 2352 wrote to memory of 2284 2352 net.exe 35 PID 2352 wrote to memory of 2284 2352 net.exe 35 PID 2352 wrote to memory of 2284 2352 net.exe 35 PID 2420 wrote to memory of 1152 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 20 PID 2420 wrote to memory of 1152 2420 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe"C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2284
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD51e9f97cc35138767ad33d8ecf8e68cd9
SHA12f996e70426b1226f60833376fdc80fcca241ebd
SHA2564f8f440f83f1f52240316cef94af0b3421dc5bcf1412185c8033ae25445fc8dd
SHA51212ef3b98f6c57a8141fb4cb84280bab5038628d798740be3c6a0defaaa37d74ef7f270bc648dd0dabb64ea7489f8dfc45809b0a2e0314cf08dfaef96525aaebe
-
Filesize
717KB
MD5528b5bba23da4783b42cafad5e1c60d7
SHA1b64e96efb00977bd1d8a0c949046b32ae23856eb
SHA256cad496a930baf44dad0eb8b0e9c34f8fccf2410984bca5955aba7c66c15a0f04
SHA512922b56cd83e867faa8e47d48d7c903c6af4de470538f2eaa49620124fb24ec59dd2c57ff32abd93152ed3462534b5296bb6f75e6721241695510fb8b2cd33b52
-
Filesize
478KB
MD588ebffeda5f485117bea8ed1af2bc7a2
SHA1ffe087732bb54277e9e3d34fdce899d667bb90bd
SHA2563d884ccebaba6949715611435af8a26d9c343650d0914383b0405bb0d2685b9b
SHA5122f786abb377cfac242e2e58214e465c8146cb02f58e3bbedfe25d8f641e001a7e043ce0d176a6bbb77aaea8f791287ba0e37467032652e1116ad35e4f9137870
-
Filesize
9B
MD5f7d2b8208aeaba3c31668cdcaae5c0d7
SHA1dbf13d797480dc1a10de2a6164557103660e81c9
SHA25670e7188042cdd89d0c810f2efbce72a86afd08d50aaa4b527f96a802a1e139b9
SHA512972ff3f39a2693026bb2b8baacb54564b9ceb80e9073ed338ec80d413a7cd6b126969068f44f196b93864ea82e6dbeada0ffc94c65754b7bba82469386161c40