Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 16:14
Static task
static1
1 signatures
General
-
Target
dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe
-
Size
1.1MB
-
MD5
4c9959f9d1db195e6323d48e5d176fe1
-
SHA1
d752ae365569da9649cf7d9f31d2a81add78b65a
-
SHA256
dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6
-
SHA512
c6445de5ae013d17bcff6e95930aba5fb62026b54e2c3827b2dc4c07bd7ccbb0ab6b1d03764b55f1fac70c82660ba585a20db293659203143615814dbae3c4b1
-
SSDEEP
24576:T3Nef9AiKGpEoQpkN2C4McuKo0GTNJpyT5RGeQa0s:Tde+GtCi27mVHyT+a0s
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4396 Logo1_.exe 1096 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Trust Protection Lists\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Visualizations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\edge_BITS_4368_823923101\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe Logo1_.exe File created C:\Program Files (x86)\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe File created C:\Windows\Logo1_.exe dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe 4396 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1392 wrote to memory of 2852 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 85 PID 1392 wrote to memory of 2852 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 85 PID 1392 wrote to memory of 2852 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 85 PID 2852 wrote to memory of 368 2852 net.exe 87 PID 2852 wrote to memory of 368 2852 net.exe 87 PID 2852 wrote to memory of 368 2852 net.exe 87 PID 1392 wrote to memory of 4404 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 91 PID 1392 wrote to memory of 4404 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 91 PID 1392 wrote to memory of 4404 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 91 PID 1392 wrote to memory of 4396 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 93 PID 1392 wrote to memory of 4396 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 93 PID 1392 wrote to memory of 4396 1392 dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe 93 PID 4396 wrote to memory of 4536 4396 Logo1_.exe 94 PID 4396 wrote to memory of 4536 4396 Logo1_.exe 94 PID 4396 wrote to memory of 4536 4396 Logo1_.exe 94 PID 4536 wrote to memory of 4716 4536 net.exe 96 PID 4536 wrote to memory of 4716 4536 net.exe 96 PID 4536 wrote to memory of 4716 4536 net.exe 96 PID 4404 wrote to memory of 1096 4404 cmd.exe 98 PID 4404 wrote to memory of 1096 4404 cmd.exe 98 PID 4396 wrote to memory of 4764 4396 Logo1_.exe 99 PID 4396 wrote to memory of 4764 4396 Logo1_.exe 99 PID 4396 wrote to memory of 4764 4396 Logo1_.exe 99 PID 4764 wrote to memory of 1296 4764 net.exe 101 PID 4764 wrote to memory of 1296 4764 net.exe 101 PID 4764 wrote to memory of 1296 4764 net.exe 101 PID 4396 wrote to memory of 3468 4396 Logo1_.exe 56 PID 4396 wrote to memory of 3468 4396 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe"C:\Users\Admin\AppData\Local\Temp\dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E0E.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe"C:\Users\Admin\AppData\Local\Temp\dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe"4⤵
- Executes dropped EXE
PID:1096
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4716
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1296
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5dc01a6ab4cf6e84d10d802d41c268220
SHA13b45ebeb7158cf667b125efbd2e417071bb2819d
SHA256024c028dcc86ae283878cfe848b86f5539d1c14ebc9f3ef9ee46510c4a30e407
SHA512a7d6f1120067ba5fc44d3fb57dc42f93cb6c08310c3dd3a11fdc42b01dd2931168e0dd0a42f6b8e4b55f6300ce28aae2a96e9d6ebf1498aff56ac305f4fc554d
-
Filesize
582KB
MD5f610140e8045de75c009b0817ec73c97
SHA1c6d4da7f61f9f37c2e136a2c21b3f875c8cbe74e
SHA256a2bdb669d734dd9b58c8012f459bc49e1aa9a539b6adc11d8ad1e31a3ca594b6
SHA5127c634b39c6be95ec8be5861e6cc53cd9e32137b8588da259465f8acf2f7c6c90f475ac143b23ba3c2c27ee7a8265c02485d5dd42ca5b5d94a3cf2bd3240547da
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5aa1f66c378cbdbcb7882e245c07b9def
SHA1e50b4c0b495f97317f96ae0c42ca452b504e3970
SHA2561aa4de231335138bca74aa29fdf52f58adbe09b68e8d717e6549a0ad400c6f8f
SHA5129894d2bae12941be81164f3d00f9d90b69b421f9dbbd4436937ef667783a70d70c640e3fd5e7855bcb9e9ece0e04d2866140692dadffc19a3de1e8bf661ed9ed
-
Filesize
722B
MD5938549a322b99b16a6fda131e7a7b447
SHA174d74e309035981f6803d4ea222f27d02f9402f1
SHA256c75e7a0765058a2bb6de4c2291c04538f96ed8cd34a216ffd58f05dd8e63577b
SHA51279f647b5a8b1df7c9bbfd748adae637aee4758aa421baa34291e2232b796119d671d9886767719267662a9dca29e3930d5987a650c70ada603a1893ab3f0da08
-
C:\Users\Admin\AppData\Local\Temp\dbf92f8c6d2c64d33dc6248b4c660f65df730a4b38715a448d704a3da8babbd6.exe.exe
Filesize1.1MB
MD509239e688ff75cd636ac932100b243f9
SHA12a7964c81b9a34bb77c4e3676e7d31b7d2668297
SHA256a36ef4c18a08ee8d8c0d10d96ab37a0c3ce22a8f328733af8c0451579e4edcb1
SHA512686708321d8756ddcfa2d1585ca7261be0ece33bd9d134888cdb4655b8484c727b34b4ac7f12d919184e85ab65088bc565549c262289cb64f9aeca0508290825
-
Filesize
33KB
MD51aeb31ee1d951ea2e78a19f5b23cd7e4
SHA13dd09718e9e4bcc2a03d11456815d56b4e2587c4
SHA256537daec8665ada5375e0c87619d5d0992bfe0e7d9c976702554e20ae857eb6f9
SHA51206cbed6a3557d9f57d0e2e4ace95ff43501dc8a83262db49ce6d4feba98026c5453432048ba3bb55a4c339479d34384c3081d0e2b27daa09a00be0226daed2a1
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD5b7ec1da49148e97bf44f32e8f6d562b0
SHA1957456b7a1d8c1f9b7bdfb5105d0d92005e74159
SHA256aba4a691666b271da9aa9ccb8261bb6c7bbf763942555ff56423e46e00d032bb
SHA51230cd415a858163446330517079193e6c9a50f5dd1b08b4536546e508a0f40c7f9da83649a4dd6579b714d27f797ba075fd043be31e6ee6fd44c51a479fb710ae