Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2024, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe
Resource
win7-20240903-en
General
-
Target
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe
-
Size
33KB
-
MD5
acea89f403bcb47ee1d946bcda6fd439
-
SHA1
a919c58021cec518e83830e534b687c2063fdba3
-
SHA256
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf
-
SHA512
eb629979a847d4107088dc15c1fe0ca34b87f76de8e30bc4b2ec167604fc200fe78d235e1a3f940861428f3c8d325fb1dc82ed424238dac8f2b8cb7ed33ca6e1
-
SSDEEP
384:CbbBSGIAF+GPO5RQ0JvoNcAJAS6X4S39AaxIINU716CYlC5nQLiX/zrnFOlVCFlI:mxt5PO5RroZJ767395uINUh5dIInc
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\U: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\R: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\Q: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\J: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\X: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\E: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\O: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\T: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\S: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\P: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\N: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\M: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\L: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\I: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\Y: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\V: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\K: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\H: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\G: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened (read-only) \??\Z: 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\3B9D3023-9E41-4144-80F7-056F252AE726\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\WindowsApps\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Dll.dll 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe File created C:\Windows\rundl132.exe 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3552 wrote to memory of 4248 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 83 PID 3552 wrote to memory of 4248 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 83 PID 3552 wrote to memory of 4248 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 83 PID 4248 wrote to memory of 1088 4248 net.exe 85 PID 4248 wrote to memory of 1088 4248 net.exe 85 PID 4248 wrote to memory of 1088 4248 net.exe 85 PID 3552 wrote to memory of 2476 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 89 PID 3552 wrote to memory of 2476 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 89 PID 3552 wrote to memory of 2476 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 89 PID 2476 wrote to memory of 3712 2476 net.exe 91 PID 2476 wrote to memory of 3712 2476 net.exe 91 PID 2476 wrote to memory of 3712 2476 net.exe 91 PID 3552 wrote to memory of 3540 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 56 PID 3552 wrote to memory of 3540 3552 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe"C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1088
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD5d8445e3c33aa7cf4e7dad5ee2d82ff97
SHA131cd4be9005d330070f0a785b3be7bbca41b5633
SHA256b2c68dcdf45647714381979b098770f8438770d2570546cca189542842b879b0
SHA512b6a14b6f41865dc0e35f07319061304981e6245709ed9cd9b02e57e149c2b1fc78d98f18d6daeb1219e935fba76891a8f8d657a1b460e7751678492531114cde
-
Filesize
176KB
MD54555fe35ce759bcd003af1e51f2e4f6f
SHA1b10547096d62f3a4a9035712fc65f4afbba190d6
SHA256efc665c01345ec8f06cedaf78e0c2d07bdec3b3beaf3e84b7825dea453169923
SHA512620783191a9b7869e7fe113636d876f0a06100001790beb26245a73150d2a79523e287959d920e214c483dd086b88c3c96b73c8fa31778ed54532691d1029211
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5bc39de0e7ce4a364aef222509a15c2c0
SHA1149133051e80a25bfa8bbcf5b504da0895d2d315
SHA256c56d31fac01d70b70dffefabef3b181525386687002dd3432931bcf8454ad7f9
SHA5120e0bb42ede861f28b3886001bff0172cf3f985bb38bd13145c356d7c8d7ae0597dda87ddf7e44c159e18cabd514dfbca84ccbc9bc704aabaf978b899eaec1c46
-
Filesize
9B
MD5f7d2b8208aeaba3c31668cdcaae5c0d7
SHA1dbf13d797480dc1a10de2a6164557103660e81c9
SHA25670e7188042cdd89d0c810f2efbce72a86afd08d50aaa4b527f96a802a1e139b9
SHA512972ff3f39a2693026bb2b8baacb54564b9ceb80e9073ed338ec80d413a7cd6b126969068f44f196b93864ea82e6dbeada0ffc94c65754b7bba82469386161c40