Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe
- Size 29KB
- Sample260511-ll69yahw8j
- SHA256 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79
- MD5 55454725c57eaeb8abb6a53eb69f55b8
- SHA1 9a8c261ba010cac88c8a71c95f957462c793a954
- SHA512 69800a55e984a56bd92040b0277419f99faec7631bf39948777a68adf7a0b5e451da9c8880ae152962d850546addffb8d2d3018ab1ca2aa9083b699e857a1307
- SSDEEP 384:Nbbek00L831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pKRIQ16GVRu1yK9fMnJG2V9dHS8
- TLSH T10BD2D06073C96563E6A11FF058E34FA64526FC10DF8DC24F9E547A8FDCB05309962A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\G: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\M: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\Z: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\Y: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\W: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\R: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\N: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\L: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\J: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\I: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\X: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\V: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\U: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\P: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\O: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\K: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\H: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\E: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\T: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened (read-only) \??\S: 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\lt-LT\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\tslib\test\validateModuleExportsMatchCommonJS\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\css\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_~_8wekyb3d8bbwe\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4504 wrote to memory of 4692 4504 082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe 80 PID 4692 wrote to memory of 3632 4692 net.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe"C:\Users\Admin\AppData\Local\Temp\082fb71005b9a74115ee05446f1a555121ae3a90e827a1b0d1a371b1349cda79.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3632
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
- Size 128KB
- SHA256 facba50b0393f4088d6913a4fa41988b0aa2c45012a5f53926b6dc6e26d380ef
- MD5 372ca6628bbd1e4ae17e24ff3c21a4f9
- SHA1 c0f51cd6390de6dca3c9702c06f254302906883d
- SHA512 e7f52e64e9ef78127d273a87234bc3fdd327c24f25fcd54ad767afffb80112f32c668e6381e066802f3dc1564637ee17ea88736d79b905245097496c935ce82e
- SSDEEP 3072:ptCkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:HHuJ5YCk3ET+Tu3fCUzB+JHI
- TLSH T15AD39C1376D08472E5B2193108A1EEB1893EFD625E50CE6B37D41B3E0F316D1DE26A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 173KB
- SHA256 a9acaed9fef457cbc3f6fcd02a6ca4823cb76f433512d333e4c3361ccedb2beb
- MD5 306be464f155f1c19ed08bf669d0f3bb
- SHA1 2316718db7d19a76e6ec17d4575d384c62979663
- SHA512 78edad4f00a5baef5a3d61f917facda6bea38a6e916fac5ea47dd5912bd1fd0010f9814f496f27432bf6f19271780e38a433141a1186f11fdb69eaa54589d54a
- SSDEEP 3072:pLCkuJVLnvJ9psmeIBcV8pQFq4XKF3QP6:hHuJB3psmeI+sQFqT3Qi
- TLSH T1A704261AD29802E9C06E6275C7968A41B7337C2587E1D3CB57D0F53E0F766909EEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 484KB
- SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
- MD5 23a05a0c17f72a64890ebc4e18b211da
- SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
- SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
- SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
- TLSH T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
- Size 9B
- SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
- MD5 6fafb008947daa1d3538f70fcc12a422
- SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
- SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
- MD5 SHA1 SHA512