Analysis
- max time kernel
150s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 10:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe
- Size 44KB
- Sample260425-mvsctafx2v
- SHA256 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2
- MD5 ca1b3a65b3c0b9dd5f6ac1102bd5fbb0
- SHA1 43ce743a77b629ababeee7ce55743dd9dc35acf5
- SHA512 c93ffbf03a8af931853b65bfb61d990ed7ae6259ef384f2ea05a5201498e8a4c78799ef930f7c313843abadc340e0726b3812057d8b8ce4a23c069d3c98f050b
- SSDEEP 768:hYkmT2ljlL5b+/ScqpLTQZBd+vry+1oUEKtBF5fn3ZTJAzONE1d05JyA:6Qj95b+lcTQ7d+XoGhv3dJKOY8MA
- TLSH T17813E0075F4E5A65D091A23836B75F45D6349C403421C60EA7A4708CEEF2790FE8AAAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\N: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\K: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\Z: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\Y: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\T: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\R: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\G: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\X: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\S: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\P: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\L: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\J: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\I: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\W: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\U: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\Q: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\M: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\H: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\E: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened (read-only) \??\V: 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Windows NT\Accessories\it-IT\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\root\Office16\osfFPA\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File opened for modification C:\Program Files\Windows Media Player\en-US\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe File created C:\Windows\Dll.dll 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4988 4412 7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe 79 PID 4988 wrote to memory of 3184 4988 net.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe"C:\Users\Admin\AppData\Local\Temp\7eb801694feb5bc42b6f47d07556ad4b476259a410bc8cd6e4180a439d28b7e2.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3184
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
- Size 6.7MB
- SHA256 64deaf8f1676329a0c373ebccd0e1b59844eb9cbc2422d709d7b8f94082f410c
- MD5 6ed8668c5a5532ca8b55d0d37093e39f
- SHA1 4f448a2c2686e6718bf4bb4a623c0b3fcc9cbaee
- SHA512 303dda126cf732a1cea89b22bc11122917525081b40261fdf9f95e38b9d2825093436344a24eb443771bb637076fe45e792c190b261f2bf75920dcdbaf9048f3
- SSDEEP 98304:DWl8YfTaJ1+WN1+WpyeB2L4HrZtbPIieK5M0uR7F5eE:DW8YfTaR8L6IiFUpIE
- TLSH T121665B47E2A600A8E46ED970CF3A5521DA353C8E57B493EF129476E81A32FD47B38F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-1383858298-2057492509-1726743289-1000\_desktop.ini
- Size 9B
- SHA256 49ae628b21eceb52cfae7af66d488c736e334e8e5a05bacaac62b3ddd791251b
- MD5 acdb534d0253a176a2a0e1fd11e837b9
- SHA1 a527b792940d294bca3c2fcec3cc01f48de60689
- SHA512 ae6fee904c215193b2a84e2af6e46875b5c4ede55ec8a53eb88fc6204a207329b7b4e140e16c0630b3df64395b8533c4773e1a2157b654962d7c1390dc8097fe
- MD5 SHA1 SHA512