Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 16:14
Static task
static1
1 signatures
General
-
Target
efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe
-
Size
75KB
-
MD5
8ebdcaf6fbc92463685d03d5b213316f
-
SHA1
9587fb9b53ec8be62b7f51c39ce7a4cd40ed8340
-
SHA256
efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5
-
SHA512
1ad2a8ce4c10306fd892024a9f9f65b2d8ea42533425264e00082078ea3508773c91d52e2ff26a5710e22012a7631d3ced370b08791bdd3117d752b6a9f597f5
-
SSDEEP
1536:2EaYzMXqtGNttyeiZnZLYm1XEToa9D4ZQKbgZi1dst7x9PxQ:2EaY46tGNttyeQLYm1DlZQKbgZi1St7y
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3136 Logo1_.exe 732 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_feedback\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\132.0.2957.140\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe File created C:\Windows\Logo1_.exe efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe 3136 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 860 wrote to memory of 3192 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 86 PID 860 wrote to memory of 3192 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 86 PID 860 wrote to memory of 3192 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 86 PID 3192 wrote to memory of 4116 3192 net.exe 88 PID 3192 wrote to memory of 4116 3192 net.exe 88 PID 3192 wrote to memory of 4116 3192 net.exe 88 PID 860 wrote to memory of 5024 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 92 PID 860 wrote to memory of 5024 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 92 PID 860 wrote to memory of 5024 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 92 PID 860 wrote to memory of 3136 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 93 PID 860 wrote to memory of 3136 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 93 PID 860 wrote to memory of 3136 860 efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe 93 PID 3136 wrote to memory of 920 3136 Logo1_.exe 95 PID 3136 wrote to memory of 920 3136 Logo1_.exe 95 PID 3136 wrote to memory of 920 3136 Logo1_.exe 95 PID 5024 wrote to memory of 732 5024 cmd.exe 97 PID 5024 wrote to memory of 732 5024 cmd.exe 97 PID 920 wrote to memory of 1632 920 net.exe 98 PID 920 wrote to memory of 1632 920 net.exe 98 PID 920 wrote to memory of 1632 920 net.exe 98 PID 3136 wrote to memory of 3380 3136 Logo1_.exe 102 PID 3136 wrote to memory of 3380 3136 Logo1_.exe 102 PID 3136 wrote to memory of 3380 3136 Logo1_.exe 102 PID 3380 wrote to memory of 1376 3380 net.exe 104 PID 3380 wrote to memory of 1376 3380 net.exe 104 PID 3380 wrote to memory of 1376 3380 net.exe 104 PID 3136 wrote to memory of 3584 3136 Logo1_.exe 56 PID 3136 wrote to memory of 3584 3136 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe"C:\Users\Admin\AppData\Local\Temp\efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a491F.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe"C:\Users\Admin\AppData\Local\Temp\efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe"4⤵
- Executes dropped EXE
PID:732
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1632
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1376
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5dc01a6ab4cf6e84d10d802d41c268220
SHA13b45ebeb7158cf667b125efbd2e417071bb2819d
SHA256024c028dcc86ae283878cfe848b86f5539d1c14ebc9f3ef9ee46510c4a30e407
SHA512a7d6f1120067ba5fc44d3fb57dc42f93cb6c08310c3dd3a11fdc42b01dd2931168e0dd0a42f6b8e4b55f6300ce28aae2a96e9d6ebf1498aff56ac305f4fc554d
-
Filesize
582KB
MD5f610140e8045de75c009b0817ec73c97
SHA1c6d4da7f61f9f37c2e136a2c21b3f875c8cbe74e
SHA256a2bdb669d734dd9b58c8012f459bc49e1aa9a539b6adc11d8ad1e31a3ca594b6
SHA5127c634b39c6be95ec8be5861e6cc53cd9e32137b8588da259465f8acf2f7c6c90f475ac143b23ba3c2c27ee7a8265c02485d5dd42ca5b5d94a3cf2bd3240547da
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5aa1f66c378cbdbcb7882e245c07b9def
SHA1e50b4c0b495f97317f96ae0c42ca452b504e3970
SHA2561aa4de231335138bca74aa29fdf52f58adbe09b68e8d717e6549a0ad400c6f8f
SHA5129894d2bae12941be81164f3d00f9d90b69b421f9dbbd4436937ef667783a70d70c640e3fd5e7855bcb9e9ece0e04d2866140692dadffc19a3de1e8bf661ed9ed
-
Filesize
722B
MD56a230909c0a44a78423001f39d46cca5
SHA1df634d0921728f380cf539da0abe3af9ac088e14
SHA2566ae0153d26c18336cd8c45eabb4aa1fef11237125ddd20af63a2e06d8f077a8a
SHA5124f27dd627ff767777e0cd5d1155b688adb99e36d59d48beb65bf7b0418bc6126f51b17fe03ada7bc442394d04f346c8e4217e7e31f3a0a7e8f0ea08d4f9d39c8
-
C:\Users\Admin\AppData\Local\Temp\efb2e7abfca1956d31c9ff7b4290205047dd4a019a64fa1eb8e24ebb6828d3c5.exe.exe
Filesize41KB
MD5977e405c109268909fd24a94cc23d4f0
SHA1af5d032c2b6caa2164cf298e95b09060665c4188
SHA256cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
SHA51212b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
-
Filesize
33KB
MD51aeb31ee1d951ea2e78a19f5b23cd7e4
SHA13dd09718e9e4bcc2a03d11456815d56b4e2587c4
SHA256537daec8665ada5375e0c87619d5d0992bfe0e7d9c976702554e20ae857eb6f9
SHA51206cbed6a3557d9f57d0e2e4ace95ff43501dc8a83262db49ce6d4feba98026c5453432048ba3bb55a4c339479d34384c3081d0e2b27daa09a00be0226daed2a1
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD5b7ec1da49148e97bf44f32e8f6d562b0
SHA1957456b7a1d8c1f9b7bdfb5105d0d92005e74159
SHA256aba4a691666b271da9aa9ccb8261bb6c7bbf763942555ff56423e46e00d032bb
SHA51230cd415a858163446330517079193e6c9a50f5dd1b08b4536546e508a0f40c7f9da83649a4dd6579b714d27f797ba075fd043be31e6ee6fd44c51a479fb710ae