88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1

Analysis

max time kernel
149s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2025, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
Size 185KB
Sample250703-dvw7bstsat
SHA256 88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1
MD5 81564bcfd1280f307623a8c3191516f7
SHA1 92a2aad9e89b4bd66f8b2a1ec1afd9124c322d4f
SHA512 fe95baa7b5db0a1adc5b0f859ef78366054bc8e855c40c2a43bc106d3b6bdf4b5d12a5dec2f049737a38732f631a8fe1508863e8ef88ec1c0f2d75780df7e26f
SSDEEP 3072:/AUe+a+3dN53ARYLJXJoYtpA/H3RpDecC+EZX70RjLTu46R0Eb:m+aMVgYLjvqXRpDecw7Kj3u46db
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2660	Logo1_.exe
1568	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Media Player\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\disabledupdater.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
File created	C:\Windows\Logo1_.exe	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3916	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	78
PID 3840 wrote to memory of 3916	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	78
PID 3840 wrote to memory of 3916	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	78
PID 3916 wrote to memory of 3524	3916	net.exe	80
PID 3916 wrote to memory of 3524	3916	net.exe	80
PID 3916 wrote to memory of 3524	3916	net.exe	80
PID 3840 wrote to memory of 3756	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	81
PID 3840 wrote to memory of 3756	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	81
PID 3840 wrote to memory of 3756	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	81
PID 3840 wrote to memory of 2660	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	83
PID 3840 wrote to memory of 2660	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	83
PID 3840 wrote to memory of 2660	3840	88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe	83
PID 3756 wrote to memory of 1568	3756	cmd.exe	84
PID 3756 wrote to memory of 1568	3756	cmd.exe	84
PID 2660 wrote to memory of 3044	2660	Logo1_.exe	85
PID 2660 wrote to memory of 3044	2660	Logo1_.exe	85
PID 2660 wrote to memory of 3044	2660	Logo1_.exe	85
PID 3044 wrote to memory of 1036	3044	net.exe	87
PID 3044 wrote to memory of 1036	3044	net.exe	87
PID 3044 wrote to memory of 1036	3044	net.exe	87
PID 2660 wrote to memory of 3092	2660	Logo1_.exe	88
PID 2660 wrote to memory of 3092	2660	Logo1_.exe	88
PID 2660 wrote to memory of 3092	2660	Logo1_.exe	88
PID 3092 wrote to memory of 5876	3092	net.exe	90
PID 3092 wrote to memory of 5876	3092	net.exe	90
PID 3092 wrote to memory of 5876	3092	net.exe	90
PID 2660 wrote to memory of 3344	2660	Logo1_.exe	52
PID 2660 wrote to memory of 3344	2660	Logo1_.exe	52

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3344
- C:\Users\Admin\AppData\Local\Temp\88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
  "C:\Users\Admin\AppData\Local\Temp\88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7223.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe
      "C:\Users\Admin\AppData\Local\Temp\88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe"
      4⤵
      Executes dropped EXE
      PID:1568
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 582KB
SHA256 8fbdfbd598c5187a59b50b4cc3d1a8b540a6779dc8fe0e0d11ace36f99e5dc0f
MD5 5faa9173c2e433e4d85d80b914fc42c8
SHA1 1cb3335484862cd6714dd150e841240b75276f5d
SHA512 cf6901224a54b89eae641ed5297fd038ccc8ecf058160f1baaa9635ae6c8e631d795cf669b1ad53f0b62ac3b4554f0c96a3635b86f735cb21ac0b6aaa7341d0b
SSDEEP 12288:m+aMjXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:mB40Le5ji0hmxNrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 488KB
SHA256 99750acff09f51ecc7a0d7ce91e67e855e8602b6e8059ade2c177a52f27f74e7
MD5 7600621cb832d468eb5a7f0b8c2d6a29
SHA1 4645a79bdcd74de5e14c7a6bb8772769c1f691e5
SHA512 b3da2f8e25ba9d06c757511ea7b030095f80f80de629077c4f3d8745a8155e35e953a5e0fcd69f6d47d56fdb533ad6af24efc99ba80c16ec80c9032e1d114b37
SSDEEP 12288:+3+aMBqIOkU8AMXE9B7PElZlP41N+4PUWfo:QBwBOkUhMXcBwc04nA
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a7223.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7223.bat
Size 722B
SHA256 e485c0aff68060e1e8bef90d3d8567b984ce0cab0c10072443843a3b7885ea7f
MD5 19c0496eca99ed246746699a1bfa4b11
SHA1 e834a8154f1d1331adbd5015d6fd4c1094ae562c
SHA512 46f01ffc0c0120dceccbb394210c98b7c8afffb11fb4ba58ecaea8e73b3c45c51923d43fe5cd3057701df83884e3a9d4eac084ccdd3cb1d7be377a70d98d38c7
MD5 SHA1 SHA512

Submit Download

88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\88f7c271aeedea3ea7059668922a79aecb8a7fda8ce0f9b7b60052fe80d089f1.exe.exe
Size 152KB
SHA256 37462e31a348d32c9421557f38a601a632c0bdf24d8157481ba82b45f8fef64f
MD5 3440c72d695db245adb2728b6a5d9b1d
SHA1 1e510973687c9a0b58464aaf43048a183d825e26
SHA512 5be93dca3a1f9b8e286146d43f848ef6b8bc5ef99ca5cf50839a62dd5083d915dc94ca5a30658838e2365a45a5dd522e641ee71f811202148c9db860113018e6
SSDEEP 3072:ZARYLJXJoYtpA/H3RpDecC+EZX70RjLTu46R0Eb:ZgYLjvqXRpDecw7Kj3u46db
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 bb853bba22b68bf0ef590e67b316c590fa3f87cf374a65a285926b4c74d95487
MD5 f5ad136796aee056cf6eaeffd9f625b5
SHA1 22091a80d731bb7699fdb3794aa02d8dba954fe4
SHA512 22c6895e3b9f4682448410c95c39bcc3fc05510bedf6dade5e1824f6db42cbb10bd0a4c567c839d28788eeb7fb73c98e6e32626faf6d4d71a60f0c715f206df6
SSDEEP 768:/6RdUO5RroZJ76739sBWsNscWlM3dN9N3ZjfPP:/6rUe+Zk78NR3dN5nP
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1418876453-2228697459-2788511057-1000\_desktop.ini
Size 8B
SHA256 959a6a9558282444d1dd98433d955169a5d02eae7694bf72f4b5cca03c8f8e8a
MD5 19b275752f698c40be7d59102cdd63fa
SHA1 2b0b13c3276f9090b62d1c89e19a4d9670996379
SHA512 7732b86d8f48256871417b0019a921e0af1660f15e7c2a8ba439c4332ad27ca2ae4ae06175ceb1596aac85e6c14b4f4a06bd0095919f69abc2b8de84c7d6c0aa
MD5 SHA1 SHA512

Submit Download

memory/2660-1651-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2660-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2660-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2660-8698-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2660-10133-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3840-11-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3840-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download