082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
Size 29KB
Sample260511-ll69yahw8j
SHA256 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79
MD5 55454725c57eaeb8abb6a53eb69f55b8
SHA1 9a8c261ba010cac88c8a71c95f957462c793a954
SHA512 69800a55e984a56bd92040b0277419f99faec7631bf39948777a68adf7a0b5e451da9c8880ae152962d850546addffb8d2d3018ab1ca2aa9083b699e857a1307
SSDEEP 384:Nbbek00L831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pKRIQ16GVRu1yK9fMnJG2V9dHS8
TLSH
T10BD2D06073C96563E6A11FF058E34FA64526FC10DF8DC24F9E547A8FDCB05309962A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\S:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\Q:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\K:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\J:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\I:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\G:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\X:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\W:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\V:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\T:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\R:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\O:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\N:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\M:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\Z:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\P:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\L:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\H:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\E:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened (read-only)	\??\U:	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Extensions\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2216	4384	082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe	86
PID 2216 wrote to memory of 3052	2216	net.exe	88

C:\Users\Admin\AppData\Local\Temp\082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
"C:\Users\Admin\AppData\Local\Temp\082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 2c928dc0662e9d5d68e3ec73f2d11e94b542c74887b238bc2b1eb5c0e376c8df
MD5 4b8ed5ac7979296f66df5b80e511dd29
SHA1 a31273fd29fe3009a367e0709c10554915f84573
SHA512 2abfe8e695a00bd9ece85b98b88db942a3e6fb42ae3f9e8d49dd63a9d505a124cdae7a84602b44ff106908e6510bcb6d347f3f588c9ebcba90c082301b99af62
SSDEEP 3072:ptCkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:HHuJtYCk3ET+Tu3fC0zB+JHv
TLSH
T185D39C1376D08472E5B2193108A1EEB1893EFD625E50CE6B37D41B3E0F316D1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 721KB
SHA256 0e12a2a697a4c415316434bb4739931960a36c86f6de5cb1791eef231430d8b6
MD5 ecb2cb0d287ced8227317be3ba178d6f
SHA1 50342d5f01ede206f481e376e3a30014d67b10e5
SHA512 f7fd81203f0feb98fcc403cea629c3339c20bd929966333c72713acd642f6ad059f45a39894e0a844b9dfbbe0b8483bfa369b0a19ac2ba1119580bd9a75f9085
SSDEEP 12288:h5VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:vVbqPb88hv/l+7
TLSH
T1EEF42A66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
MD5 23a05a0c17f72a64890ebc4e18b211da
SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
TLSH
T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-914486190-3969805341-592249730-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/4384-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-606-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-1278-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-6-0x0000000000660000-0x00000000006D5000-memory.dmp

Download

memory/4384-5069-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-5-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4384-5584-0x0000000000400000-0x0000000000436000-memory.dmp

Download