Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 07:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe
- Size 32KB
- Sample260728-h31lyadn7s
- SHA256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9
- MD5 030258f9d63513ad25c6bd50970de9c4
- SHA1 81d09e992b442d6c549a7050a8681b9dff445401
- SHA512 d509bddfad5ab1790a66427e5dd293693eda71403b9e4f274d9bbca5d9dc596daac6b1ecd6830cb27a2c67b226e3daee3b5f86edfef9214e789ebee34bfe5dda
- SSDEEP 768:Jkw6T2ljlL5b+n8WF6mucTqDf2KDVX2AmXtzCNt:Jh5j95b+n8wKcTDKDVmAmX5CNt
- TLSH T156E2D042A3DA9D28E49A8C3446D71BF1E5B4BCB0E9604B5EC2E0665FDEB03D46E11A70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\N: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\I: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\H: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\Z: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\Y: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\W: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\T: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\R: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\O: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\M: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\L: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\V: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\U: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\Q: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\P: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\K: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\J: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\G: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\E: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened (read-only) \??\S: 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Google\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Windows Photo Viewer\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLSTART\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe File created C:\Windows\Dll.dll 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe - Program crash 2 IoCs
pid pid_target Process procid_target 880 2256 WerFault.exe 84 4384 2256 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1292 2256 269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe 85 PID 1292 wrote to memory of 4596 1292 net.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe"C:\Users\Admin\AppData\Local\Temp\269b9cc4dcc516892c22a7dce0bc4231fe7067adc2e9baa60f8f6e2b581776d9.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 9802⤵
- Program crash
PID:880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 9802⤵
- Program crash
PID:4384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2256 -ip 22561⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2256 -ip 22561⤵PID:3044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path F:\$RECYCLE.BIN\S-1-5-21-889581200-2041691093-2048517887-1000\_desktop.ini
- Size 9B
- SHA256 9357bcb826b88b8cc398d32adb480a67b076712d3ac7bf7209d3c568d1e66bfd
- MD5 e28b2367207351382fe96f46d104a185
- SHA1 06740704241469cadaad9aab25adb1811c056714
- SHA512 134dcbe647b913c2b1af39360c9c9e1d384ddb553b97d561fda249f52e4397c251fcda5dfa5bb320a2676c51aa489eaed9a4c47d3506b4ab983a4ff711009864
- MD5 SHA1 SHA512