Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 09:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe
- Size 29KB
- Sample260509-lwt3cset7x
- SHA256 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040
- MD5 1f5cb857f3eaa4236f6211a620f23394
- SHA1 ecb35974eef47a65a35441a99daf53ea13423c0d
- SHA512 25720b719393d68e3a65c83e212a4d38e65e7a9d472f39fede05688a05e8c43532c0ee911a04eef7d812c74c71492f6cf322a81419fa75c47b1a7701ddab94af
- SSDEEP 384:NbbfC21Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pu216GVRu1yK9fMnJG2V9dHS8
- TLSH T103D2D06373FF6E66E2915FF018A34FA6862BF151CCCE824F5D24B6454E9070056E2633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\O: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\W: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\R: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\P: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\M: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\K: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\J: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\I: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\Y: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\Q: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\H: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\G: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\E: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\X: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\V: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\U: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\T: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\S: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\N: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened (read-only) \??\L: 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Google\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\et-EE\View3d\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_feedback\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\x64\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4476 wrote to memory of 1240 4476 6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe 84 PID 1240 wrote to memory of 3460 1240 net.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe"C:\Users\Admin\AppData\Local\Temp\6f087fb29668bac99066ba66a402ebffe5300579ac01ffb681e2ea509666c040.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3460
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
- Size 128KB
- SHA256 152ad87c4261bf6c1294fba96c2f6cfb908fc45446dc6ad9f56b8c78bd070a36
- MD5 5379f2f8f3132fb735426e41dbe8f3c1
- SHA1 2f5de84579994b1186ca01e7688c01c37010ac6c
- SHA512 165e6b4f19d92c70b6344ec7f754dffcdb12951f726367c02e818a9f769130c5c5d85bb90d23243d94bc72bba9d15415af8ece66740b4b891f9f5e57dd11f19f
- SSDEEP 3072:pgkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:PuJtYCk3ET+Tu3fC0zB+JHv
- TLSH T189D39D1376D18472E5B2593108A1EE718A3FF9624D94CE6B33D42B3D0F316C1DE26A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 173KB
- SHA256 890a5cd3eebc6733320654cc25142945e8784bb8f4e4c8898245e8590ec0ade0
- MD5 cce09e1e7be627c6d7d2d64c5b94cb49
- SHA1 1eab59006f559a24ca5a4d5ffccc6731312bff0c
- SHA512 6d10a0bae5852aeaf6c03b6039d219de3e94c2e78a92cfa3e3c4cd708ed669fc32d95b8e28eb9a325a08e8b5e644318e279d88a890b4368d335267c6fb61fabb
- SSDEEP 1536:pl3SHuJV9NnvJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:plkuJVLnvJ9psmeIBcV8pQFq4XKF3QP6
- TLSH T1B804161AD29802E8C06E6275C7568A41B7337C6687E1D3CB57D0F53E0F766809EEAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 484KB
- SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
- MD5 6098ea38ec05a4b6b3cfe01ae79052f0
- SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
- SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
- SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
- TLSH T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2714754311-527593155-1440850301-1000\_desktop.ini
- Size 8B
- SHA256 6e9be20748ee78b11d664f31b9547ee836b5e73f3d4ef05289327d7f1ba0eb14
- MD5 40ceb2ed83210f4185f76feb1846e3d0
- SHA1 e8b81c1d0babb9887ef3703b2804d6d1a2f31d63
- SHA512 62538e5d4e898b44b402a6c1f2a32edd5945428b2891b38363935cf3d358a7638f88313b7be5209c29be487b899cca3ba7d53923a193cf06b722fec679357ef1
- MD5 SHA1 SHA512