0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
Size 29KB
Sample260706-grs72saw31
SHA256 0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d
MD5 8409e4d9b2afc44efee314b1a387288e
SHA1 4bdc99cbc22d3ee380780bfce0f33c14198884af
SHA512 786404f8fb1bc2de624828ffc90c37dc301ba3a1e0dd0525f0c30e3d80bd56d4e614dc326186a8f4cc800c6e288021057d36e0576390fcf4abd76fe821b58e1f
SSDEEP 384:NbbUZU1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pwZU16GVRu1yK9fMnJG2V9dHS8
TLSH
T100D2D02173EC58A3F4651BF018E3CFAAC915F124ED68835F3D790B5E3D621405AB1A07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\R:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\O:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\M:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\L:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\J:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\H:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\W:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\U:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\I:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\Z:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\Y:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\X:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\T:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\Q:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\P:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\K:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\D:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\V:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\N:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened (read-only)	\??\G:	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ar-ae\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Google\Update\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Extensions\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\win10\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 3876	6020	0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe	88
PID 3876 wrote to memory of 1316	3876	net.exe	90

C:\Users\Admin\AppData\Local\Temp\0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe
"C:\Users\Admin\AppData\Local\Temp\0d29b1e8dae12abc4b54006e1425e676f16dc1395825a71f8edc14f7b65e819d.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 173KB
SHA256 38e05ce74c1a55828ec72dfcc6e81e47f9202b43bce54c782136c2b6026605d8
MD5 2c558598a7130194c4d9cb3f94a0d1e2
SHA1 cbb894bd7423070e9a21c7e2dc7f91ea7dd8a6af
SHA512 7625e57c9b9a7124b21fb7e6b126af1ce705f642b650280917625ae1f9762249e3ef2ebdb61cea9d3d1c81026967b6a47d78ee8ad85021dbcb15e9a93e56cab0
SSDEEP 1536:pwZ+3SHuJV9NnvJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:pjkuJVLnvJ9psmeIBcV8pQFq4XKF3QP6
TLSH
T1DC04171AD29802E9D06E6275C7968A41B7337C2587E1D3CB53D0F53E1F766809EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 7c14b30092e8e4566d7e6d4bbca011dcbbe58eae3a181427162d853ad9017722
MD5 4981b880da0987ffdc81f909b03f83cc
SHA1 26c39f20e2e8d185a9af12a4e332a4d3c95a0f7f
SHA512 2edda6268a30f808808aab351d13e2b7f6ade6c09af6b8167c7496ce28bf43310d5cb1193ce3a9900d5a69d848e3c956ffc143267136c29e67e88920b863d4a9
SSDEEP 6144:w9uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wvqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1FDB46D31E6A44037D6F106B3F915D6307E7DA2187B1184AB9394AE2D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2639994890-966400312-4246138405-1000\_desktop.ini
Size 8B
SHA256 eda859e985b4b1bbbce0f798c0e1c2c8a042a6f9c08844c9bb81cdd30b322ee0
MD5 2199c1e9414dc13935f87db0bfb40ba4
SHA1 85d4af0086fe0c77bec308c7200fee8791cd63c1
SHA512 3583c03f6127fe6896bdda96b49a4b9bf558461463dfbebdaa070caf5ad2565a790c74cef1e228a5d9b55f38281e217fe0b28bf4f50a11f0b96487e5e16fca36
MD5 SHA1 SHA512

Submit Download

memory/6020-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-5-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-18-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-96-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-1229-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-5024-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6020-5497-0x0000000000400000-0x0000000000436000-memory.dmp

Download