6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
Size 66KB
Sample241109-hc223synfy
SHA256 6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b
MD5 7a0e52903fcd633d176d63f427617aed
SHA1 7370bf17667632b35d1d33b582fbff5a03eb6f6d
SHA512 a58042797907c2816f792cd6a3a09d13fb47391e785b688fea5714f53cc71a114457f3333c248042f21e642ffbe343cb5991297efb819bdd8d73daa2593d3b67
SSDEEP 1536:JTzaYzMXqtGN/CstC9qVF4awuzXv4exFRKs9uhh:JTzaY46tGNFC0VF4awuzX+kuX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1108	Logo1_.exe
1700	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
File created	C:\Windows\Logo1_.exe	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe
1108	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2344	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	83
PID 3004 wrote to memory of 2344	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	83
PID 3004 wrote to memory of 2344	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	83
PID 2344 wrote to memory of 3584	2344	net.exe	85
PID 2344 wrote to memory of 3584	2344	net.exe	85
PID 2344 wrote to memory of 3584	2344	net.exe	85
PID 3004 wrote to memory of 1876	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	89
PID 3004 wrote to memory of 1876	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	89
PID 3004 wrote to memory of 1876	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	89
PID 3004 wrote to memory of 1108	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	91
PID 3004 wrote to memory of 1108	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	91
PID 3004 wrote to memory of 1108	3004	6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe	91
PID 1108 wrote to memory of 1484	1108	Logo1_.exe	92
PID 1108 wrote to memory of 1484	1108	Logo1_.exe	92
PID 1108 wrote to memory of 1484	1108	Logo1_.exe	92
PID 1484 wrote to memory of 2264	1484	net.exe	94
PID 1484 wrote to memory of 2264	1484	net.exe	94
PID 1484 wrote to memory of 2264	1484	net.exe	94
PID 1876 wrote to memory of 1700	1876	cmd.exe	95
PID 1876 wrote to memory of 1700	1876	cmd.exe	95
PID 1876 wrote to memory of 1700	1876	cmd.exe	95
PID 1108 wrote to memory of 3380	1108	Logo1_.exe	97
PID 1108 wrote to memory of 3380	1108	Logo1_.exe	97
PID 1108 wrote to memory of 3380	1108	Logo1_.exe	97
PID 3380 wrote to memory of 2844	3380	net.exe	99
PID 3380 wrote to memory of 2844	3380	net.exe	99
PID 3380 wrote to memory of 2844	3380	net.exe	99
PID 1108 wrote to memory of 3436	1108	Logo1_.exe	56
PID 1108 wrote to memory of 3436	1108	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
  "C:\Users\Admin\AppData\Local\Temp\6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9163.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe
      "C:\Users\Admin\AppData\Local\Temp\6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe"
      4⤵
      Executes dropped EXE
      PID:1700
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 d3b719c109b1544ec69d65729698f5c011541a9c33fd7f200751fb2a5e21c102
MD5 b021e611ebc76c429cac2c42e07fa0bb
SHA1 98773d25254ede793800737983446101245e6e78
SHA512 c3a5f09a7e183901bc50a02e4f25022530f0ea8452163b5551c5e838cafb7516762849d44086dbdd1767fbd28c9e87ac05fb38beba37338df93f3583a2aeb961
SSDEEP 12288:BF3WFjn7a3iwbihym2g7XO3LWUQfh4Co:T3Mq+gkE2fh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 0669173c40d97e844b6f4d54d6adb07436977db52e41e5f5bc947b79d7520f58
MD5 1fe9a7fdaeea26266d63eb1b096769f7
SHA1 262ceddf29b57db2c655afcec7370aabb02a5acf
SHA512 bde3426c732f8bae61a790ece59a9e290b1076cf451da8f54fb121923751b0a1328c2322bf628712e327b49160bcae0c415056775f7a43f7fe1f2c9a5efd2529
SSDEEP 12288:QF3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a9163.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9163.bat
Size 722B
SHA256 c70cc1ac0966c61ea3f99a9c87a054dcc606d198a6452e561b92fddd72b09ea3
MD5 e633d4769fc7883d2a10dd980fe51ac6
SHA1 47e43907a434b57cda8f98217fa7f0c44bbbfa16
SHA512 bd4ce0f2670dcf7ab68988eabe6f10cb8d3bd990e0a36d15bb2201daedfa5a751535323fa5a498f1e592e09b9d28356ca907c717579a9497d52a2bf327351164
MD5 SHA1 SHA512

Submit Download

6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\6dd91787bd47c257c9a81c54e677aa039b28d68c61a6c03c07559d647f28671b.exe.exe
Size 33KB
SHA256 e2bbf624927463534b2757974ef38f453faee9564736e4672e1481273f6cfc48
MD5 1af55e19c1bd264d635aa202f0b3e628
SHA1 e7cc75ca40566fc257974340b611ba24ed09b3f3
SHA512 bb967372d392f4e320490212053fbb09637b472b3636443c7dfd1dde993ee91a7033a4c48ac9e25ebaf20d72c9f3dcb9d497d6b153ee7bdf65389caa81996f71
SSDEEP 768:eahOhuz+aj4n24exXVRMNsjt6xAkUuhL9:eawuzXv4exFRKs9uhh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 296b5f7d593bdfcb4931c4b9961a0bd1d97c436c1c6b0a00596b25061a53df6d
MD5 a115a35138ae26025c1b5bb77b5f65b3
SHA1 bfaa205bf902f1a29a97a5ef954c3f8616fc1f83
SHA512 45d40c68995140699463042dfe542340ad0040d2cfa093af6c76e2a6545c4284928d9151714d540dc31947b1c010a8db138b69dd3d8cddc0d2ba0d27a1b18f0d
SSDEEP 768:JTJYkElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JTzaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1045960512-3948844814-3059691613-1000\_desktop.ini
Size 9B
SHA256 e22c9759bcf5bc35063c6c048e109883f070723446b9ed5d16e70c48ca526bb9
MD5 577b020fd4f1c33364f7dc1b6a15b5e0
SHA1 0a39afa020279d2ae46b302efe9dfd550e822709
SHA512 c7b8e4478ddc648c13acd21b16fa7397fad334d7710e3d91f4069fcd7d5a4f3d8c542c46eb3843c4dbc8d862bf03a50d1ad641e725f53382a73a9ac4ec035f48
MD5 SHA1 SHA512

Submit Download

memory/1108-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1108-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1108-3416-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1108-8866-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3004-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3004-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download