38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
Size 29KB
Sample260715-str9baax2z
SHA256 38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c
MD5 9bd870b6276f8d2dd5f0cdd6948af5f3
SHA1 4228244d619dd5d3ac9644542427071505b71efc
SHA512 f37da1b2c35ac1974b0d8d240f412e4b2180ec4de4330172d81572d5c4a0d14cd34ad33a587992adf03304a9bf2e17febe21d163ec55a2f3b32bf8e6e28d6a2e
SSDEEP 384:Nbbhbwi1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pFX16GVRu1yK9fMnJG2V9dHS8
TLSH
T1B1D2D06533EE6953E4611BF464D3DFBA8825FD64DC69822F2E38774E1CB08409E62B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\V:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\S:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\P:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\O:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\M:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\D:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\Z:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\X:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\U:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\T:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\K:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\J:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\I:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\G:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\L:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\W:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\R:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\Q:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\N:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened (read-only)	\??\H:	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\Windows Defender\Offline\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Extensions\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Extensions\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\_desktop.ini	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 3528	5352	38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe	88
PID 3528 wrote to memory of 5152	3528	net.exe	90

C:\Users\Admin\AppData\Local\Temp\38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe
"C:\Users\Admin\AppData\Local\Temp\38a63fd1ec11bda0ab4f819939c3d6b051d7885a4b8e9ecb64b512fa0836744c.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 bd528d7c34fed2bad511536826f8e6e3663661f38f3cbf7563b368e4090fef01
MD5 7cbcd669eb4a465230aa3a9f70d329d2
SHA1 074b6d41e8d30ba1cac86376a666a597cb31b303
SHA512 49f3bd8cd6ce4ae0db6311af6919177d4d3ef132e9464a1a76102153a9fb2fa7a0a3c650f109168122a9cfb08e1a9d71658cb0690562159604da73590245f073
SSDEEP 6144:fCuJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82gF:UXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1A2C40916F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 7c14b30092e8e4566d7e6d4bbca011dcbbe58eae3a181427162d853ad9017722
MD5 4981b880da0987ffdc81f909b03f83cc
SHA1 26c39f20e2e8d185a9af12a4e332a4d3c95a0f7f
SHA512 2edda6268a30f808808aab351d13e2b7f6ade6c09af6b8167c7496ce28bf43310d5cb1193ce3a9900d5a69d848e3c956ffc143267136c29e67e88920b863d4a9
SSDEEP 6144:w9uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wvqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1FDB46D31E6A44037D6F106B3F915D6307E7DA2187B1184AB9394AE2D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 9B
SHA256 e364702191d7bad386e0e119e959764fa8ba675a1c38bf293de851a39dfb46d1
MD5 5163114d1812c769004b2acd9a93d8b3
SHA1 9a60427ef77ae3c8f56b3ebdcc646bc2e1452f1a
SHA512 5f8863247d2dd65b928806a0a633254932cf6e3cfec669a63d9caf9b94b4c438dbb23060d91c6d9034be1ad11946f3edec5906d7ebfaebaf181f135af462cfb6
MD5 SHA1 SHA512

Submit Download

memory/5352-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-5-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-18-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-81-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-1232-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-5029-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5352-5502-0x0000000000400000-0x0000000000436000-memory.dmp

Download