Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2025, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
Resource
win7-20240903-en
General
-
Target
c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe
-
Size
1.1MB
-
MD5
8251bb2b18a80f9596b37e0f0810275f
-
SHA1
614b54d3770069f279dcb75cfd38d86fee30839d
-
SHA256
c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a
-
SHA512
06ce0977957c31f28db4d842615b6c7cd1012f641e12e1813178c4798a3dddc1c5276e47a8c2cedcfba5aa10fd00997a917b83979b687deb4bcf77fb727acf2d
-
SSDEEP
24576:m3MTXT9T+w6zY8v5a2FZ7WDpk2Kvfd5nP6Wp8zrMBThYBjv:mcZ6zY8/7WDaDvfd5iQ8zoBThojv
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1520 Logo1_.exe 4348 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe File created C:\Windows\Logo1_.exe c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe 1520 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4504 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 82 PID 4572 wrote to memory of 4504 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 82 PID 4572 wrote to memory of 4504 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 82 PID 4504 wrote to memory of 4548 4504 net.exe 84 PID 4504 wrote to memory of 4548 4504 net.exe 84 PID 4504 wrote to memory of 4548 4504 net.exe 84 PID 4572 wrote to memory of 396 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 85 PID 4572 wrote to memory of 396 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 85 PID 4572 wrote to memory of 396 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 85 PID 4572 wrote to memory of 1520 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 86 PID 4572 wrote to memory of 1520 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 86 PID 4572 wrote to memory of 1520 4572 c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe 86 PID 1520 wrote to memory of 4868 1520 Logo1_.exe 88 PID 1520 wrote to memory of 4868 1520 Logo1_.exe 88 PID 1520 wrote to memory of 4868 1520 Logo1_.exe 88 PID 4868 wrote to memory of 3180 4868 net.exe 90 PID 4868 wrote to memory of 3180 4868 net.exe 90 PID 4868 wrote to memory of 3180 4868 net.exe 90 PID 396 wrote to memory of 4348 396 cmd.exe 91 PID 396 wrote to memory of 4348 396 cmd.exe 91 PID 1520 wrote to memory of 4296 1520 Logo1_.exe 92 PID 1520 wrote to memory of 4296 1520 Logo1_.exe 92 PID 1520 wrote to memory of 4296 1520 Logo1_.exe 92 PID 4296 wrote to memory of 4968 4296 net.exe 94 PID 4296 wrote to memory of 4968 4296 net.exe 94 PID 4296 wrote to memory of 4968 4296 net.exe 94 PID 1520 wrote to memory of 3392 1520 Logo1_.exe 56 PID 1520 wrote to memory of 3392 1520 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe"C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76E5.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe"C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe"4⤵
- Executes dropped EXE
PID:4348
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3180
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4968
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5cd74a661390a025788bb8d581b8997fe
SHA10d8b0ad53ffba3d0ee68e2fb75b20a0cdd46fa79
SHA2565072864ce1a620293be18521b1b13c9c1d0677578c14578e9a097f67d30224a3
SHA51261ae0a82f4e839911d547a2b653d657c143f9d3529206d68bf84492320261c621d936a6b2fa97946e4d56a3c0f91380d4a1ee7c6fa66ad297fdf104d4623dc90
-
Filesize
577KB
MD5c646d99cc49f1d66be90cf4b78a2ada2
SHA198096072883c22562359ee8fc602e4028dd1095e
SHA256c93aba49a86b7af2659a7cf20033f05e469caf6eb699c385662cafe93f03b64e
SHA512a591e68a4adea138da4c79d012e1c6a32defbfb079d16ce02c7de5ba42ac2a2b312d082a493856ea3981ab3d3ee72235c8b2cded3b5c3803c257d24061e4a8c7
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD50eec0543603f7a8ce8e8f5fee478e1d2
SHA1f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA256636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
SHA512cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
-
Filesize
722B
MD5a33c0245f7b81a155a82d2acd0cbe675
SHA1d62bf7feff4abdbf8c218583d31930ee468afdfe
SHA25632eb96d711f4659ca26f8f41f01c6fcdff37a7a4e91ee5bca48791deaf1ee7ec
SHA512d0d3ef62d77fe1e450d19d3fdb9a928b07178ceecec7df782c3fcce916d83035f2e6d5a88fedc5791a5755edce89dab850e83dd498f88bfc48b04d90349fc66e
-
C:\Users\Admin\AppData\Local\Temp\c1b200965a46f955ed36e01b820b80503a16bda448c4663e71e10ef1f589379a.exe.exe
Filesize1.1MB
MD5f012ebe3b9f0c4d18b43076b68295667
SHA127ce582d305bf5ec574fd7edf39e1300783e9323
SHA256bdff5163ff3787a7a8b6bb3f688e877c5fa10db2ad535bb9765c91e976fbcafe
SHA51206ce3eceb42ca555511f55e85fe79441a4a8c70ad32c36a045560cb8449e44f08bcd9e938e9a11a0360c7363ba2fff4dd92b1a300e21e214a6d273009d8c2463
-
Filesize
33KB
MD599171473455f287bf3271f2200d81338
SHA160a188feb436b02bf71167001ed8e553df610534
SHA25697ae3f5a8b3fb129735fcab7e9c48a1711224be57eacb83aaf7284bcb06b888c
SHA5124864ebdf3a8f5f51c5f9cdfd5ac3ea64cb2c7852c62dbfc3375632192ec15dfe3979d2225ceb05a4098539e4023c3f8c8550745164a4d28a850e23ea6e63d41b
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD58f7e93ddb13ba90485e607a464d90e13
SHA1cf8017b3bf7648edfeb3ebabc6ec30e0a588bff0
SHA256adaafb82143154ec0c4f4a9ec25824de92a30b708876cc276fae77a83f161ca8
SHA51256ccb7556b9c2563f254f947d63d72d05ffbf7cfaec65ef3f0fb94ae6f95c708c8652002d88af13e5ac35cde6ebb8f2834572392b52a938a1c2e84a063306b78