a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
Size 26KB
Sample260527-vtlsmsd12q
SHA256 a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc
MD5 a895c60520a7367b0bb376cdadab73be
SHA1 409df5821207f66553e6bdc8710dd2a3af81140b
SHA512 2209ee9f6033b1ef812602c729709f0bf3280b9faf5a39c1c47268cd8a6f8bc570f410726879f141d81578828b427a15c86d299ea9f91f08257579e653998e23
SSDEEP 768:e1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:4fgLdQAQfcfymN
TLSH
T12AC2E1BC96F96634DC264EBCDBDA530243ED0A7DC0AE213539A2957A2101BB5204EF23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\R:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\N:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\E:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\Y:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\X:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\U:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\O:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\L:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\K:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\I:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\W:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\S:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\Q:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\P:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\J:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\Z:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\V:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\M:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\H:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened (read-only)	\??\G:	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2021.2012.41.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Breadcrumb\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.113.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\es-es\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_game_assist\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\en-us\_desktop.ini	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1316	2924	a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe	80
PID 1316 wrote to memory of 4856	1316	net.exe	82

C:\Users\Admin\AppData\Local\Temp\a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe
"C:\Users\Admin\AppData\Local\Temp\a376b5a57ed020d57f6166acdd503bfd60d18d15fe4d2c8228ad4d35a75e25dc.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 0571d51340106df5b3e9c78fb7b0e56971ad1a9669be7dde9bac0a2de2a3296c
MD5 eccbb92d895f1dabf59f571bf941d87c
SHA1 4465475304d6b3a8b08b57efd502ed102cd9c61b
SHA512 079d49413d8ee0f42f30740a62ba3983a19bf6f0f87ef88546c146d594f2452f104f25f8262096a47315b923824f0757059982750f7703025194cac3539914a6
SSDEEP 3072:eftffjmNvYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:GVfjmNvYCk3ET+Tu3fCUzB+JHI
TLSH
T1ABC39C1375E0C472E4B2593109A0EA718A7EFD624950DE6B33D41A3E0F317D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 170KB
SHA256 23a1f66155853035457404b2b5f0b64aa0fa4ef0b38d155509e90fcf0ed68384
MD5 c434ac5039f55632c1258ea35321b16f
SHA1 d323d6e6f9ec4f47973f0704a6f9ee985c5ac6a2
SHA512 bb802d0655339147c899e9898bae4899dde7c1957dfa002d975a511c7ebfc67c452ac74728a9da8ca8cded962566da8de28e316f3271a4a74f6fb0e45a41ba61
SSDEEP 3072:4ftffjmNXvJ9psmeIBcV8pQFq4XKF3QP6:IVfjmNX3psmeI+sQFqT3Qi
TLSH
T1B104071AD29802E8C06E6179C7968A41B3777C6583E1D3CB53D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 1f06570aa3d1064cd6e7bb1641c7660e9991de3dfe2f36dcf7168a7ca50f822e
MD5 f2f0fc2163d1d3b8943f7c8ce8652717
SHA1 aa16c31090c81095065f77f884f1a1be1c5bc858
SHA512 a839f70d5294d1971b0d36c98189ce41054837f70fffc9f5232b116103ba4e14c3470c4414b5cdfd25d4abe7cf5723d74671497021f12f095a2ea733ea15db22
SSDEEP 12288:vp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:x7/BOkUhMXcBwc04nA
TLSH
T18CA47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2409539145-3342400454-2096821238-1000\_desktop.ini
Size 9B
SHA256 90660789145a1e303418de25f012f2cba7ff1d4dc5994f0c5212b2ab04edd7fd
MD5 25028b7169d40ab30de68048e493cd12
SHA1 f5045e7771e266ce03273df7b06fc6100dfc36ba
SHA512 91c6bce3388caa8f881195ea7d2328f21be026f3f46a6a90770de94f802aaa20d8186551d293a77e211d28c042a9def309202a2c7dbe15a6fa2fda178589d0f2
MD5 SHA1 SHA512

Submit Download

memory/2924-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-741-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-1209-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-5-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-4990-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-5493-0x0000000000400000-0x0000000000434000-memory.dmp

Download