Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 16:14
Static task
static1
1 signatures
General
-
Target
880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe
-
Size
307KB
-
MD5
4043f462ac50a772fe95d6daf0dfc1fb
-
SHA1
22b7ceeb6ece27b4156a29fcc6aeb5daf2262411
-
SHA256
880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a
-
SHA512
c7c018343733a7b1df468e7b120d732249246f8895925d379b41ecb681f049c92fb45aaf8f00441b8abcf15c81f93f2b4c1ad4442ff5a17b1d48fb14f912227c
-
SSDEEP
6144:T46tGdye41jObiZKDAX0jH0o2zq9DmQ3LOotL4gr:T3NbYbiZKm4H8zq9Fjtdr
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 988 Logo1_.exe 3432 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\loc\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe File created C:\Windows\Logo1_.exe 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe 988 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3360 wrote to memory of 3188 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 86 PID 3360 wrote to memory of 3188 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 86 PID 3360 wrote to memory of 3188 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 86 PID 3188 wrote to memory of 2408 3188 net.exe 89 PID 3188 wrote to memory of 2408 3188 net.exe 89 PID 3188 wrote to memory of 2408 3188 net.exe 89 PID 3360 wrote to memory of 1148 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 92 PID 3360 wrote to memory of 1148 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 92 PID 3360 wrote to memory of 1148 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 92 PID 3360 wrote to memory of 988 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 93 PID 3360 wrote to memory of 988 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 93 PID 3360 wrote to memory of 988 3360 880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe 93 PID 988 wrote to memory of 4372 988 Logo1_.exe 95 PID 988 wrote to memory of 4372 988 Logo1_.exe 95 PID 988 wrote to memory of 4372 988 Logo1_.exe 95 PID 4372 wrote to memory of 4404 4372 net.exe 97 PID 4372 wrote to memory of 4404 4372 net.exe 97 PID 4372 wrote to memory of 4404 4372 net.exe 97 PID 1148 wrote to memory of 3432 1148 cmd.exe 99 PID 1148 wrote to memory of 3432 1148 cmd.exe 99 PID 1148 wrote to memory of 3432 1148 cmd.exe 99 PID 988 wrote to memory of 1880 988 Logo1_.exe 100 PID 988 wrote to memory of 1880 988 Logo1_.exe 100 PID 988 wrote to memory of 1880 988 Logo1_.exe 100 PID 1880 wrote to memory of 4596 1880 net.exe 102 PID 1880 wrote to memory of 4596 1880 net.exe 102 PID 1880 wrote to memory of 4596 1880 net.exe 102 PID 988 wrote to memory of 3516 988 Logo1_.exe 56 PID 988 wrote to memory of 3516 988 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe"C:\Users\Admin\AppData\Local\Temp\880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F23.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe"C:\Users\Admin\AppData\Local\Temp\880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe"4⤵
- Executes dropped EXE
PID:3432
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4404
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4596
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5dc01a6ab4cf6e84d10d802d41c268220
SHA13b45ebeb7158cf667b125efbd2e417071bb2819d
SHA256024c028dcc86ae283878cfe848b86f5539d1c14ebc9f3ef9ee46510c4a30e407
SHA512a7d6f1120067ba5fc44d3fb57dc42f93cb6c08310c3dd3a11fdc42b01dd2931168e0dd0a42f6b8e4b55f6300ce28aae2a96e9d6ebf1498aff56ac305f4fc554d
-
Filesize
582KB
MD5f610140e8045de75c009b0817ec73c97
SHA1c6d4da7f61f9f37c2e136a2c21b3f875c8cbe74e
SHA256a2bdb669d734dd9b58c8012f459bc49e1aa9a539b6adc11d8ad1e31a3ca594b6
SHA5127c634b39c6be95ec8be5861e6cc53cd9e32137b8588da259465f8acf2f7c6c90f475ac143b23ba3c2c27ee7a8265c02485d5dd42ca5b5d94a3cf2bd3240547da
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5aa1f66c378cbdbcb7882e245c07b9def
SHA1e50b4c0b495f97317f96ae0c42ca452b504e3970
SHA2561aa4de231335138bca74aa29fdf52f58adbe09b68e8d717e6549a0ad400c6f8f
SHA5129894d2bae12941be81164f3d00f9d90b69b421f9dbbd4436937ef667783a70d70c640e3fd5e7855bcb9e9ece0e04d2866140692dadffc19a3de1e8bf661ed9ed
-
Filesize
722B
MD536f8bfa6e185d18f1d6057c1da63f168
SHA1152dbadae5a5a21983ce318e0dd45479aa6b2253
SHA25604ec1e80b7eae5b4552544b5f9a511fc39610191a75c92862f4d837d454b6508
SHA512671f1c0c8bbd084ec0d2086c3f18b784641ff3261ff75fa9bb8dca3bca67321b6af8182a93dd20c53276939494e652fd866f101a00647c3862bbd444de3c1b84
-
C:\Users\Admin\AppData\Local\Temp\880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a.exe.exe
Filesize273KB
MD555e392d1bd55a1292b6ce766225416e5
SHA106d8134a3002e6974407fb5da0a59ab43415a52a
SHA256db42cb95904cfc6891df2aa736506fb34a26cf9a26e88ab0ef262e0459344a3e
SHA5120c55062cf8debbdf1a7a4f41527e43cd124fb7777e9b930de9cc900abf9c27a1956a536200e23dddc9a4068ac5bc9a8052299a4f2cf010cffd205a32d99581a2
-
Filesize
33KB
MD51aeb31ee1d951ea2e78a19f5b23cd7e4
SHA13dd09718e9e4bcc2a03d11456815d56b4e2587c4
SHA256537daec8665ada5375e0c87619d5d0992bfe0e7d9c976702554e20ae857eb6f9
SHA51206cbed6a3557d9f57d0e2e4ace95ff43501dc8a83262db49ce6d4feba98026c5453432048ba3bb55a4c339479d34384c3081d0e2b27daa09a00be0226daed2a1
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD5b7ec1da49148e97bf44f32e8f6d562b0
SHA1957456b7a1d8c1f9b7bdfb5105d0d92005e74159
SHA256aba4a691666b271da9aa9ccb8261bb6c7bbf763942555ff56423e46e00d032bb
SHA51230cd415a858163446330517079193e6c9a50f5dd1b08b4536546e508a0f40c7f9da83649a4dd6579b714d27f797ba075fd043be31e6ee6fd44c51a479fb710ae