Analysis Overview
SHA256
1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf
Threat Level: Shows suspicious behavior
The file 1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf was found to be: Shows suspicious behavior.
Malicious Activity Summary
Reads user/profile data of web browsers
Drops startup file
Enumerates connected drives
Drops file in Program Files directory
Drops file in Windows directory
System Location Discovery: System Language Discovery
Unsigned PE
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-08 13:18
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-08 13:18
Reported
2024-11-08 13:20
Platform
win7-20240903-en
Max time kernel
150s
Max time network
119s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
Reads user/profile data of web browsers
Enumerates connected drives
Drops file in Program Files directory
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\rundl132.exe | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Windows\Dll.dll | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe
"C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe"
C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
Network
Files
memory/2420-0-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1152-3-0x0000000002F90000-0x0000000002F91000-memory.dmp
memory/2420-8-0x0000000000400000-0x000000000043F000-memory.dmp
F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\_desktop.ini
| MD5 | f7d2b8208aeaba3c31668cdcaae5c0d7 |
| SHA1 | dbf13d797480dc1a10de2a6164557103660e81c9 |
| SHA256 | 70e7188042cdd89d0c810f2efbce72a86afd08d50aaa4b527f96a802a1e139b9 |
| SHA512 | 972ff3f39a2693026bb2b8baacb54564b9ceb80e9073ed338ec80d413a7cd6b126969068f44f196b93864ea82e6dbeada0ffc94c65754b7bba82469386161c40 |
C:\Program Files\7-Zip\7zG.exe
| MD5 | 528b5bba23da4783b42cafad5e1c60d7 |
| SHA1 | b64e96efb00977bd1d8a0c949046b32ae23856eb |
| SHA256 | cad496a930baf44dad0eb8b0e9c34f8fccf2410984bca5955aba7c66c15a0f04 |
| SHA512 | 922b56cd83e867faa8e47d48d7c903c6af4de470538f2eaa49620124fb24ec59dd2c57ff32abd93152ed3462534b5296bb6f75e6721241695510fb8b2cd33b52 |
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
| MD5 | 1e9f97cc35138767ad33d8ecf8e68cd9 |
| SHA1 | 2f996e70426b1226f60833376fdc80fcca241ebd |
| SHA256 | 4f8f440f83f1f52240316cef94af0b3421dc5bcf1412185c8033ae25445fc8dd |
| SHA512 | 12ef3b98f6c57a8141fb4cb84280bab5038628d798740be3c6a0defaaa37d74ef7f270bc648dd0dabb64ea7489f8dfc45809b0a2e0314cf08dfaef96525aaebe |
memory/2420-2977-0x0000000000400000-0x000000000043F000-memory.dmp
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
| MD5 | 88ebffeda5f485117bea8ed1af2bc7a2 |
| SHA1 | ffe087732bb54277e9e3d34fdce899d667bb90bd |
| SHA256 | 3d884ccebaba6949715611435af8a26d9c343650d0914383b0405bb0d2685b9b |
| SHA512 | 2f786abb377cfac242e2e58214e465c8146cb02f58e3bbedfe25d8f641e001a7e043ce0d176a6bbb77aaea8f791287ba0e37467032652e1116ad35e4f9137870 |
memory/2420-4169-0x0000000000400000-0x000000000043F000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-08 13:18
Reported
2024-11-08 13:20
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
135s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
Reads user/profile data of web browsers
Enumerates connected drives
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\VideoLAN\VLC\uninstall.exe | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\3B9D3023-9E41-4144-80F7-056F252AE726\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\Mozilla Firefox\crashreporter.exe | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files\WindowsApps\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jconsole.exe | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Dll.dll | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| File created | C:\Windows\rundl132.exe | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe
"C:\Users\Admin\AppData\Local\Temp\1f3f520cdd0b0fc15008c4087b9128e9f9be3f8a0825ca90b45a5a63fdbb85bf.exe"
C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
Files
memory/3552-0-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3552-3-0x0000000000400000-0x000000000043F000-memory.dmp
F:\$RECYCLE.BIN\S-1-5-21-3442511616-637977696-3186306149-1000\_desktop.ini
| MD5 | f7d2b8208aeaba3c31668cdcaae5c0d7 |
| SHA1 | dbf13d797480dc1a10de2a6164557103660e81c9 |
| SHA256 | 70e7188042cdd89d0c810f2efbce72a86afd08d50aaa4b527f96a802a1e139b9 |
| SHA512 | 972ff3f39a2693026bb2b8baacb54564b9ceb80e9073ed338ec80d413a7cd6b126969068f44f196b93864ea82e6dbeada0ffc94c65754b7bba82469386161c40 |
C:\Program Files\dotnet\dotnet.exe
| MD5 | 4555fe35ce759bcd003af1e51f2e4f6f |
| SHA1 | b10547096d62f3a4a9035712fc65f4afbba190d6 |
| SHA256 | efc665c01345ec8f06cedaf78e0c2d07bdec3b3beaf3e84b7825dea453169923 |
| SHA512 | 620783191a9b7869e7fe113636d876f0a06100001790beb26245a73150d2a79523e287959d920e214c483dd086b88c3c96b73c8fa31778ed54532691d1029211 |
memory/3552-2845-0x0000000000400000-0x000000000043F000-memory.dmp
C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
| MD5 | d8445e3c33aa7cf4e7dad5ee2d82ff97 |
| SHA1 | 31cd4be9005d330070f0a785b3be7bbca41b5633 |
| SHA256 | b2c68dcdf45647714381979b098770f8438770d2570546cca189542842b879b0 |
| SHA512 | b6a14b6f41865dc0e35f07319061304981e6245709ed9cd9b02e57e149c2b1fc78d98f18d6daeb1219e935fba76891a8f8d657a1b460e7751678492531114cde |
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
| MD5 | bc39de0e7ce4a364aef222509a15c2c0 |
| SHA1 | 149133051e80a25bfa8bbcf5b504da0895d2d315 |
| SHA256 | c56d31fac01d70b70dffefabef3b181525386687002dd3432931bcf8454ad7f9 |
| SHA512 | 0e0bb42ede861f28b3886001bff0172cf3f985bb38bd13145c356d7c8d7ae0597dda87ddf7e44c159e18cabd514dfbca84ccbc9bc704aabaf978b899eaec1c46 |
memory/3552-8794-0x0000000000400000-0x000000000043F000-memory.dmp