c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
Size 29KB
Sample260601-j111csfs2z
SHA256 c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252
MD5 54433a4aa7bc521f489833291cab92ed
SHA1 c0c4f9fb2e9e2552df362f530ecf2ec958ae58ad
SHA512 5939838d5e3ffbdf837f328f4fd2707fd01d57f0a45673bbdd9016f8f2406c24933715b1c30685378d8218b64e25d6de195c0c023c702cb5a2e2029c8a0b1c46
SSDEEP 384:NbbG9XFWoCDgCw8q1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRq6:pq91lDz16GVRu1yK9fMnJG2V9dHS8
TLSH
T144D2E134B7DD65A3F2A91FF05CA35FA7882AFE21DCC9820E9D74B64A0CF09441691617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\I:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\G:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\Z:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\Y:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\X:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\W:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\S:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\E:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\T:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\R:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\Q:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\P:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\O:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\M:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\J:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\V:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\U:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\L:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\K:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened (read-only)	\??\H:	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\FeedbackHub.Core\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\MSBuild\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\Classic\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\pt-PT\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\pt-BR\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4380	3864	c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe	83
PID 4380 wrote to memory of 4416	4380	net.exe	85

C:\Users\Admin\AppData\Local\Temp\c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe
"C:\Users\Admin\AppData\Local\Temp\c44ddc9588d007f7b1750b3501b854347efc4228c920ecb09d1d65cc8e096252.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 2e27fb530c553e56fb61a1e42900739453fed603680f6f39f4424ba24b56ad4b
MD5 7619462ebf035cfbee6c647204d93118
SHA1 1b16e815b8b3182eb4d3f83806373010d2374163
SHA512 d95be6f6dabc9ea28a46af4f8d96c9a25c1a95725285489508978d535cd6072be9a7d6aed4da940ce5732f13d2eaced87ebc8390324dab47ca74d9a7700ce36b
SSDEEP 3072:paFkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:tuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T123D39D1376D184B2E5B2593108A1EEB1893EFD625D50CE6B33D41B3E0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 43KB
SHA256 345209bf7d21d652419524f8b8c570c2f94552f4095209df3ebae9ff5b5a0e70
MD5 d3bca7f0b4b89e5ddd47d87c7bb1cb0e
SHA1 16d2fb1d9f00bf2b47154989ba058f7cc3719145
SHA512 452c12ce4d2629beafc3c5e3136f679237a2b878e332ffe343fa5515c70e81cf09bdf0fcdb0ccfb2339afb7a2518b00ede48beda2d0f756bb5b05a1906fe0db9
SSDEEP 768:pq91lDz16GVRu1yK9fMnJG2V9dHS8FWQ3655Kv1KjqY1MNH:p21l13SHuJV9NpHqaN6qH
TLSH
T12213AF119BD864E2F7FA0AB068FB2F978976FD10CC84DA0E4A707B8D0C74640D696357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 0351fa0c8e9f7993bbc2b2a1997eb803c771b49baa0b6bf802ac5a63df800e35
MD5 06656fa31f70a46a86331af2a23c07ae
SHA1 d90c42d829452177d721f573ad4fa26289ee7840
SHA512 9b2155de4aa277f0407ea9144bc0fafb744f6ccd8836a9d74dd69ba43fbd42406a47dd27612af86170edc76af921ed89427df51c868ae4556c4bc63209c0914c
SSDEEP 6144:w8uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wOqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1CEB47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2824035265-2271499813-2042964211-1000\_desktop.ini
Size 8B
SHA256 f29189eb11965eb3f457dcfc9961541cf5820960ece28657e097c84d9236f547
MD5 b2a4afee50c0667bf313e9f999f7e893
SHA1 f29707b43162626674eb6eaffdd44a0afac806f2
SHA512 bf4c3ec1fad1dba2ad0771a56aa1b163902e87d76d0844bd1aeec557f42d264143ab6f53d0b005626b19ce42351515a728aea0203ee5305e4f6a264495adcf27
MD5 SHA1 SHA512

Submit Download

memory/3864-12-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-18-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-546-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-1209-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-5-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-4990-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3864-5487-0x0000000000400000-0x0000000000436000-memory.dmp

Download