Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 10:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe
- Size 44KB
- Sample260425-mvsctafx2v
- SHA256 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2
- MD5 ca1b3a65b3c0b9dd5f6ac1102bd5fbb0
- SHA1 43ce743a77b629ababeee7ce55743dd9dc35acf5
- SHA512 c93ffbf03a8af931853b65bfb61d990ed7ae6259ef384f2ea05a5201498e8a4c78799ef930f7c313843abadc340e0726b3812057d8b8ce4a23c069d3c98f050b
- SSDEEP 768:hYkmT2ljlL5b+/ScqpLTQZBd+vry+1oUEKtBF5fn3ZTJAzONE1d05JyA:6Qj95b+lcTQ7d+XoGhv3dJKOY8MA
- TLSH T17813E0075F4E5A65D091A23836B75F45D6349C403421C60EA7A4708CEEF2790FE8AAAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\X: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\W: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\T: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\K: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\H: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\G: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\V: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\R: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\P: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\O: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\N: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\M: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\L: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\Z: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\S: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\J: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\I: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\U: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\Q: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\E: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Windows Multimedia Platform\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\2B668F20-216D-4CB0-B445-62A20A35DD91\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Windows Photo Viewer\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\dotnet\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\MsEdgeCrashpad\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Windows\Dll.dll 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1112 wrote to memory of 4932 1112 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 85 PID 4932 wrote to memory of 2640 4932 net.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe"C:\Users\Admin\AppData\Local\Temp\7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:2640
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\_desktop.ini
- Size 9B
- SHA256 49ae628b21eceb52cfae7af66d488c736e334e8e5a05bacaac62b3ddd791251b
- MD5 acdb534d0253a176a2a0e1fd11e837b9
- SHA1 a527b792940d294bca3c2fcec3cc01f48de60689
- SHA512 ae6fee904c215193b2a84e2af6e46875b5c4ede55ec8a53eb88fc6204a207329b7b4e140e16c0630b3df64395b8533c4773e1a2157b654962d7c1390dc8097fe
- MD5 SHA1 SHA512