Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2025 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe
-
Size
394KB
-
MD5
89e153719570b46f306cbd62645e6d01
-
SHA1
0856f5c6d40759480d2b684b6eda78ad679e17d8
-
SHA256
ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa
-
SHA512
97b35e658b032e6cd0cae0e46ac83aa42af3b6e13ebd1911121414d36a3786fe77c426d77e9a92d51c2441c6273e7bfd5948d3bc68a2d95ba10eb31ff28bd696
-
SSDEEP
6144:SR46tGfC0jRP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuz:SR3WFjiahVy41
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 116 Logo1_.exe 4872 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe File created C:\Windows\Logo1_.exe ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3928 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 83 PID 3492 wrote to memory of 3928 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 83 PID 3492 wrote to memory of 3928 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 83 PID 3928 wrote to memory of 2604 3928 net.exe 85 PID 3928 wrote to memory of 2604 3928 net.exe 85 PID 3928 wrote to memory of 2604 3928 net.exe 85 PID 3492 wrote to memory of 4788 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 86 PID 3492 wrote to memory of 4788 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 86 PID 3492 wrote to memory of 4788 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 86 PID 3492 wrote to memory of 116 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 88 PID 3492 wrote to memory of 116 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 88 PID 3492 wrote to memory of 116 3492 ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe 88 PID 116 wrote to memory of 2188 116 Logo1_.exe 89 PID 116 wrote to memory of 2188 116 Logo1_.exe 89 PID 116 wrote to memory of 2188 116 Logo1_.exe 89 PID 2188 wrote to memory of 4120 2188 net.exe 91 PID 2188 wrote to memory of 4120 2188 net.exe 91 PID 2188 wrote to memory of 4120 2188 net.exe 91 PID 4788 wrote to memory of 4872 4788 cmd.exe 92 PID 4788 wrote to memory of 4872 4788 cmd.exe 92 PID 116 wrote to memory of 2520 116 Logo1_.exe 93 PID 116 wrote to memory of 2520 116 Logo1_.exe 93 PID 116 wrote to memory of 2520 116 Logo1_.exe 93 PID 2520 wrote to memory of 3668 2520 net.exe 95 PID 2520 wrote to memory of 3668 2520 net.exe 95 PID 2520 wrote to memory of 3668 2520 net.exe 95 PID 116 wrote to memory of 3436 116 Logo1_.exe 56 PID 116 wrote to memory of 3436 116 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe"C:\Users\Admin\AppData\Local\Temp\ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFA9.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe"C:\Users\Admin\AppData\Local\Temp\ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe"4⤵
- Executes dropped EXE
PID:4872
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4120
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3668
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5cd74a661390a025788bb8d581b8997fe
SHA10d8b0ad53ffba3d0ee68e2fb75b20a0cdd46fa79
SHA2565072864ce1a620293be18521b1b13c9c1d0677578c14578e9a097f67d30224a3
SHA51261ae0a82f4e839911d547a2b653d657c143f9d3529206d68bf84492320261c621d936a6b2fa97946e4d56a3c0f91380d4a1ee7c6fa66ad297fdf104d4623dc90
-
Filesize
577KB
MD5c646d99cc49f1d66be90cf4b78a2ada2
SHA198096072883c22562359ee8fc602e4028dd1095e
SHA256c93aba49a86b7af2659a7cf20033f05e469caf6eb699c385662cafe93f03b64e
SHA512a591e68a4adea138da4c79d012e1c6a32defbfb079d16ce02c7de5ba42ac2a2b312d082a493856ea3981ab3d3ee72235c8b2cded3b5c3803c257d24061e4a8c7
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD50eec0543603f7a8ce8e8f5fee478e1d2
SHA1f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA256636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
SHA512cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
-
Filesize
722B
MD54dba79a53a981bdeefa0ea4761057487
SHA1801f65b09337c0afa5c035de040e392354049583
SHA2567ed2108b7e70eaed567e4ceb55b7530ae77049751aa4a162db9e7ef06ac15912
SHA512ad8725813b2a26f4465a683de6208039a226c7602fdc78c64a37ce87754bc7e76fb8512350805e7a58d11f1dae9c1a8364d94f7540aa4e59e81d865472d982e3
-
C:\Users\Admin\AppData\Local\Temp\ae13a3c246c501ed2e224b99afa783f6eb65f78e586c8a179ebf094a77bb5afa.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
33KB
MD599171473455f287bf3271f2200d81338
SHA160a188feb436b02bf71167001ed8e553df610534
SHA25697ae3f5a8b3fb129735fcab7e9c48a1711224be57eacb83aaf7284bcb06b888c
SHA5124864ebdf3a8f5f51c5f9cdfd5ac3ea64cb2c7852c62dbfc3375632192ec15dfe3979d2225ceb05a4098539e4023c3f8c8550745164a4d28a850e23ea6e63d41b
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD58f7e93ddb13ba90485e607a464d90e13
SHA1cf8017b3bf7648edfeb3ebabc6ec30e0a588bff0
SHA256adaafb82143154ec0c4f4a9ec25824de92a30b708876cc276fae77a83f161ca8
SHA51256ccb7556b9c2563f254f947d63d72d05ffbf7cfaec65ef3f0fb94ae6f95c708c8652002d88af13e5ac35cde6ebb8f2834572392b52a938a1c2e84a063306b78