Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 00:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
- Target d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe
- Size 87KB
- Sample241110-akbabstrh1
- SHA256 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08
- MD5 f3b08bed9a8562d324cbff85e026602e
- SHA1 c759b2b8d5c6a8c2ac633677f84c00db803999b4
- SHA512 cadafc3cf98c0163b501933bd21634cf346987da7a54a6f5fcd5d9af91814dc4eb99e5bbb832a8f1f59b7b1cd7b11238b4d741da4c0fa582b311334628d8fef9
- SSDEEP 1536:/ne+Zk78NR3dN5nPHRbUi+QLcnC/ZMaRiIu/r:/ne+a+3dN5GnCRMaRiTT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 4856 Logo1_.exe 4508 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe File created C:\Windows\Logo1_.exe d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe 4856 Logo1_.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 836 wrote to memory of 3884 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 83 PID 836 wrote to memory of 3884 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 83 PID 836 wrote to memory of 3884 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 83 PID 3884 wrote to memory of 4400 3884 net.exe 85 PID 3884 wrote to memory of 4400 3884 net.exe 85 PID 3884 wrote to memory of 4400 3884 net.exe 85 PID 836 wrote to memory of 1676 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 89 PID 836 wrote to memory of 1676 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 89 PID 836 wrote to memory of 1676 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 89 PID 836 wrote to memory of 4856 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 91 PID 836 wrote to memory of 4856 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 91 PID 836 wrote to memory of 4856 836 d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe 91 PID 4856 wrote to memory of 1964 4856 Logo1_.exe 92 PID 4856 wrote to memory of 1964 4856 Logo1_.exe 92 PID 4856 wrote to memory of 1964 4856 Logo1_.exe 92 PID 1676 wrote to memory of 4508 1676 cmd.exe 94 PID 1676 wrote to memory of 4508 1676 cmd.exe 94 PID 1676 wrote to memory of 4508 1676 cmd.exe 94 PID 1964 wrote to memory of 1236 1964 net.exe 95 PID 1964 wrote to memory of 1236 1964 net.exe 95 PID 1964 wrote to memory of 1236 1964 net.exe 95 PID 4856 wrote to memory of 4936 4856 Logo1_.exe 97 PID 4856 wrote to memory of 4936 4856 Logo1_.exe 97 PID 4856 wrote to memory of 4936 4856 Logo1_.exe 97 PID 4936 wrote to memory of 4116 4936 net.exe 99 PID 4936 wrote to memory of 4116 4936 net.exe 99 PID 4936 wrote to memory of 4116 4936 net.exe 99 PID 4856 wrote to memory of 3436 4856 Logo1_.exe 56 PID 4856 wrote to memory of 3436 4856 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe"C:\Users\Admin\AppData\Local\Temp\d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4400
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BA8.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe"C:\Users\Admin\AppData\Local\Temp\d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe"4⤵
- Executes dropped EXE
PID:4508
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1236
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4116
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
- Size 251KB
- SHA256 68309d1c6fa8dda2d2ff3aaf12ae90297e2e1b0dfc0584c85d0607a8d463a26b
- MD5 a2f4a30c61702f94a9f13287448a3eeb
- SHA1 039f83e180211d88c13a4132bd4f8b1732dcddf0
- SHA512 ce6beacc74d38d7033da45dd8e636a321105b5054bc84bc2100476afe7ed622ba6cb7324f9d2cf5d867af0f076ea79ea1a9d1825450e065a803cb8eb472f6fe7
- SSDEEP 6144:W+aMFqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:W+aM8ml5a6EdkQgUmR7G9QK3wJx+qSf2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 8582ff82b3f7bfa3232ac60a14ab59d50dec8c57a9c7d47413be11ffc23c36c9
- MD5 6eba064bf332827bc1aa1a52aa4cb319
- SHA1 0a40d3072e22696ba5e747b69b8d8496e44470ab
- SHA512 7aeea966baa2dc2ed0a0da2c875a64cbb031fe0b055c2ef0230fa7259b7cb03f484c6a3f99a5de53ae18fa31948dab3b3319df12dedf98e12df84387a417a471
- SSDEEP 6144:m+aMKE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:m+aMR7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 643KB
- SHA256 615086abf4d14c6328dabdb7c9ab15008efc61a4fca66274f73529c276f6db65
- MD5 6cfecaa336a254849375a2c8c8a96643
- SHA1 485edaaafe1edf6c0aeaa8922d5f5d0fecc6e1e2
- SHA512 de1050e2dd1892cfae42023f3b9b855357bbc3be5a5dfa63248fb933161a4404e350a48f83818bd541268e7f2cbacb312989fe488446c85e6cbc68390a2c6163
- SSDEEP 12288:+W+aMf5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:NB+5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a7BA8.bat
- Size 722B
- SHA256 bf9405f79d89c1570184bba89307850c22e8b371d8e89bc38ea0078b2c3614a2
- MD5 cef956e3eabde65e232002d281f0734c
- SHA1 d196f203c5f6dedfbafaee3b951b9968f124aed6
- SHA512 f8e49084f37cb04692ceca31d0ad1314c2a7909de28c57f1c8859cb6154c9f3d0f462781ffbdc2249679d77e399ee6c131afcd1164b5f5eeca7e68dfdd046d8e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\d91d6711da5c6ec1f29a1cf9c2241d87f08c3830a349aa4ed5eb2dbed6d0ab08.exe.exe
- Size 53KB
- SHA256 fcfdb5e2601430a674f599e054f65471e42cb18f8484aa8d8eb38f0c6f4e9c6d
- MD5 87912631f20ab91421228cd219922519
- SHA1 71a90e384de55c6f5257466e53f6c0add270a01d
- SHA512 0843a6a6a1e7e6d394db8d939e5e11ddfbed917e262dcb41fddee490d7e1657d45edd93fa2e734a6d8419b2f935ef53c0185d626a83ef1e7d53db8e261f8fc8a
- SSDEEP 768:/eBAF7x1dbDQiYvBaj0QimpJkx9JsXQ9mbyWZMaRT51mIu/Lv:hRbUi+QLcnC/ZMaRiIu/r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37
- MD5 ad497e47848f62a27a1051e5bbe43789
- SHA1 0ddea8e45a900b14557ebbe9569bf7ec574f4374
- SHA512 09eba4fb3e1129546cb90e4d012210f03ddb45993ce05e17241af7eeac7051cfd73ef8d38ec1c3682f9b244481ef6921c6d89b128a7dc41d3fceaa8f160f1936
- SSDEEP 768:/nO5RroZJ76739sBWsNscWlM3dN9N3ZjfPP:/ne+Zk78NR3dN5nP
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3350944739-639801879-157714471-1000\_desktop.ini
- Size 10B
- SHA256 a48a9bee0ea1d148d80a848e506f13606a80f84e7f4fa4a3ceeb0f47eab1bf40
- MD5 2a3fd5c71388ca70bcd12900f65d5a77
- SHA1 7619579d21480b9a4800bc830dbf20354e50b979
- SHA512 0e803903a477f9761178c6892c45f3522f9af5b6ef550f446c0dea329dcbe2753760a17086397ff4f9c66ec93a3dbbd1e7b6aaaa71f77c70c9c8de81429c3aa0
- MD5 SHA1 SHA512