Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250610-en -
resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2025, 17:36
Static task
static1
General
-
Target
bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe
-
Size
6.0MB
-
MD5
18a7652498ab6901ed9f2e36c8b7b2b5
-
SHA1
3c86ee20d73abaa5b6ab810b2a7194bddc5b1bdd
-
SHA256
bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629
-
SHA512
a1639ed0e73756e53a7c37c575d9a4cdbcd3bbd4b6750324f1da1c4d6fb7beb2a0e4252f0ad9e5ece59363eb3dbe031167d9d79a3fda15a09cf16e5c744c1213
-
SSDEEP
98304:bYOXwnS4rVjx1LVt0Q7+Cga0Kt14vgp4R9x:8IG1Jjj14Yp4T
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\S: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\R: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\P: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\N: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\H: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\G: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\Y: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\W: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\I: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\M: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\T: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\Q: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\O: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\L: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\X: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\V: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\U: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\K: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\J: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened (read-only) \??\E: bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\edge_game_assist\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Sigma\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Windows Defender\ja-JP\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Internet Explorer\de-DE\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Internet Explorer\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Trust Protection Lists\Sigma\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\WidevineCdm\_platform_specific\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\WidevineCdm\_platform_specific\win_x64\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win10\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe File created C:\Windows\Dll.dll bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3936 wrote to memory of 3056 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 86 PID 3936 wrote to memory of 3056 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 86 PID 3936 wrote to memory of 3056 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 86 PID 3056 wrote to memory of 3580 3056 net.exe 88 PID 3056 wrote to memory of 3580 3056 net.exe 88 PID 3056 wrote to memory of 3580 3056 net.exe 88 PID 3936 wrote to memory of 2276 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 91 PID 3936 wrote to memory of 2276 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 91 PID 3936 wrote to memory of 2276 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 91 PID 2276 wrote to memory of 5088 2276 net.exe 93 PID 2276 wrote to memory of 5088 2276 net.exe 93 PID 2276 wrote to memory of 5088 2276 net.exe 93 PID 3936 wrote to memory of 3436 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 56 PID 3936 wrote to memory of 3436 3936 bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe"C:\Users\Admin\AppData\Local\Temp\bbafeb64d47ac245717e2586b6233fba8273bf476ca4c7edc8803872f039c629.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3580
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5088
-
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD545817f9ce242dfaaf8b52ecc67401e07
SHA10d7af83d1c7dc24c5b8416f1b2816b6f89b7c82d
SHA25645f16a7eb075379b3878b5194f1a79390b87c61c69eb05becaff69d596a7c6d2
SHA51222c9912d5436fe28ed81da4d8bc244ea4a3bb497c14f201aa86db600916b3e80be98765fefa41b51edf0b59bff1b3073fda6929be939233998efa92283d796fd
-
Filesize
9B
MD58d5d367ed8a2afc1fc0b8fc7d14da98c
SHA1fddfad39cd8b448d0d3dbb6e9c67752999568783
SHA25693740c0db50f557803e16032194380e92e586f9cd845c4543eae2c3aa97d95f6
SHA5123215518f650fe697fa80054e2e7e98a55a23832309347704985d502ecf46726048291ace0a619b669726fda404c9235047a21563971a238864ee3523f5bbe96b