c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
Size

1.1MB
MD5

8251bb2b18a80f9596b37e0f0810275f
SHA1

614b54d3770069f279dcb75cfd38d86fee30839d
SHA256

c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a
SHA512

06ce0977957c31f28db4d842615b6c7cd1012f641e12e1813178c4798a3dddc1c5276e47a8c2cedcfba5aa10fd00997a917b83979b687deb4bcf77fb727acf2d
SSDEEP

24576:m3MTXT9T+w6zY8v5a2FZ7WDpk2Kvfd5nP6Wp8zrMBThYBjv:mcZ6zY8/7WDaDvfd5iQ8zoBThojv

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1520	Logo1_.exe
4348	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
File created	C:\Windows\Logo1_.exe	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe
1520	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4504	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	82
PID 4572 wrote to memory of 4504	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	82
PID 4572 wrote to memory of 4504	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	82
PID 4504 wrote to memory of 4548	4504	net.exe	84
PID 4504 wrote to memory of 4548	4504	net.exe	84
PID 4504 wrote to memory of 4548	4504	net.exe	84
PID 4572 wrote to memory of 396	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	85
PID 4572 wrote to memory of 396	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	85
PID 4572 wrote to memory of 396	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	85
PID 4572 wrote to memory of 1520	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	86
PID 4572 wrote to memory of 1520	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	86
PID 4572 wrote to memory of 1520	4572	c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe	86
PID 1520 wrote to memory of 4868	1520	Logo1_.exe	88
PID 1520 wrote to memory of 4868	1520	Logo1_.exe	88
PID 1520 wrote to memory of 4868	1520	Logo1_.exe	88
PID 4868 wrote to memory of 3180	4868	net.exe	90
PID 4868 wrote to memory of 3180	4868	net.exe	90
PID 4868 wrote to memory of 3180	4868	net.exe	90
PID 396 wrote to memory of 4348	396	cmd.exe	91
PID 396 wrote to memory of 4348	396	cmd.exe	91
PID 1520 wrote to memory of 4296	1520	Logo1_.exe	92
PID 1520 wrote to memory of 4296	1520	Logo1_.exe	92
PID 1520 wrote to memory of 4296	1520	Logo1_.exe	92
PID 4296 wrote to memory of 4968	4296	net.exe	94
PID 4296 wrote to memory of 4968	4296	net.exe	94
PID 4296 wrote to memory of 4968	4296	net.exe	94
PID 1520 wrote to memory of 3392	1520	Logo1_.exe	56
PID 1520 wrote to memory of 3392	1520	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3392
- C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
  "C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76E5.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
      "C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe"
      4⤵
      Executes dropped EXE
      PID:4348
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
251KB

MD5
cd74a661390a025788bb8d581b8997fe

SHA1
0d8b0ad53ffba3d0ee68e2fb75b20a0cdd46fa79

SHA256
5072864ce1a620293be18521b1b13c9c1d0677578c14578e9a097f67d30224a3

SHA512
61ae0a82f4e839911d547a2b653d657c143f9d3529206d68bf84492320261c621d936a6b2fa97946e4d56a3c0f91380d4a1ee7c6fa66ad297fdf104d4623dc90

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
577KB

MD5
c646d99cc49f1d66be90cf4b78a2ada2

SHA1
98096072883c22562359ee8fc602e4028dd1095e

SHA256
c93aba49a86b7af2659a7cf20033f05e469caf6eb699c385662cafe93f03b64e

SHA512
a591e68a4adea138da4c79d012e1c6a32defbfb079d16ce02c7de5ba42ac2a2b312d082a493856ea3981ab3d3ee72235c8b2cded3b5c3803c257d24061e4a8c7

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
644KB

MD5
0eec0543603f7a8ce8e8f5fee478e1d2

SHA1
f975d2b0358d8f138bdbaa04e433d85297f29c2f

SHA256
636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24

SHA512
cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a76E5.bat

Filesize
722B

MD5
a33c0245f7b81a155a82d2acd0cbe675

SHA1
d62bf7feff4abdbf8c218583d31930ee468afdfe

SHA256
32eb96d711f4659ca26f8f41f01c6fcdff37a7a4e91ee5bca48791deaf1ee7ec

SHA512
d0d3ef62d77fe1e450d19d3fdb9a928b07178ceecec7df782c3fcce916d83035f2e6d5a88fedc5791a5755edce89dab850e83dd498f88bfc48b04d90349fc66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe.exe

Filesize
1.1MB

MD5
f012ebe3b9f0c4d18b43076b68295667

SHA1
27ce582d305bf5ec574fd7edf39e1300783e9323

SHA256
bdff5163ff3787a7a8b6bb3f688e877c5fa10db2ad535bb9765c91e976fbcafe

SHA512
06ce3eceb42ca555511f55e85fe79441a4a8c70ad32c36a045560cb8449e44f08bcd9e938e9a11a0360c7363ba2fff4dd92b1a300e21e214a6d273009d8c2463

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
99171473455f287bf3271f2200d81338

SHA1
60a188feb436b02bf71167001ed8e553df610534

SHA256
97ae3f5a8b3fb129735fcab7e9c48a1711224be57eacb83aaf7284bcb06b888c

SHA512
4864ebdf3a8f5f51c5f9cdfd5ac3ea64cb2c7852c62dbfc3375632192ec15dfe3979d2225ceb05a4098539e4023c3f8c8550745164a4d28a850e23ea6e63d41b

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
842B

MD5
6f4adf207ef402d9ef40c6aa52ffd245

SHA1
4b05b495619c643f02e278dede8f5b1392555a57

SHA256
d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

SHA512
a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3442511616-637977696-3186306149-1000\_desktop.ini

Filesize
9B

MD5
8f7e93ddb13ba90485e607a464d90e13

SHA1
cf8017b3bf7648edfeb3ebabc6ec30e0a588bff0

SHA256
adaafb82143154ec0c4f4a9ec25824de92a30b708876cc276fae77a83f161ca8

SHA512
56ccb7556b9c2563f254f947d63d72d05ffbf7cfaec65ef3f0fb94ae6f95c708c8652002d88af13e5ac35cde6ebb8f2834572392b52a938a1c2e84a063306b78

Download Submit
memory/1520-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-3135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-8779-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download