baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
Size 26KB
Sample260807-krhyvstyfw
SHA256 baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144
MD5 2ad271a5c271c823135b9ba96b97ab47
SHA1 7c2c881528c62b3bbbdc61afd8abd4e7413f89c2
SHA512 5ed366e8b60f03542d3992aff24bb58f5e432f69bc518b95fd4557b3ebd3f38317e6d2e836a2d197bcfb1a459abb329802a1f3b47a37ab598313a5a43188baa8
SSDEEP 768:u1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:ofgLdQAQfcfymN
TLSH
T12BC2E17913C81A74D8D649FEDBE39753833D077A259F6CAA25B24C3F6250764100FA17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\U:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\T:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\Q:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\P:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\Z:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\X:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\V:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\M:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\J:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\G:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\Y:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\S:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\O:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\K:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\D:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\R:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\N:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\L:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\I:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened (read-only)	\??\H:	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Internet Explorer\images\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win10\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3464	4960	baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe	89
PID 3464 wrote to memory of 4968	3464	net.exe	91

C:\Users\Admin\AppData\Local\Temp\baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe
"C:\Users\Admin\AppData\Local\Temp\baa9f88215d16815eec9825a47cb8dea40215243a0588aba3f5431291a651144.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 e3a7ba896117444c7a126e754b405f34aef44e5da9826c555eaa8a60852795da
MD5 ae13b43e5496c5acc22b3cadfe7fde97
SHA1 59f683f29983ef71d75acb1f03c852d716d22742
SHA512 5d456262ca1a957013ead2fa0038d1cc12c9fc235303efa5747ef3eb06140597f7803a1d731f2c3871526b837621e2c34bf83a6cdc25907c4b71349c939f9593
SSDEEP 3072:9ftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:NVfjmN2G7/fYfLvzB+QFyn
TLSH
T126C38D1372D08871E5B10C3449E1EA719E3FFA621B409EA737C4667E0F317D1DD26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 170KB
SHA256 47a146eee8e4aa650281695326e602048352d230c47a37bf55a8873514204e8b
MD5 caf2114f984098bccd4912f8467bbf04
SHA1 5c3ef90b13f2f9cc30898301306c5a69439be4e2
SHA512 273a348862d833f74f8baca2d7e34828f1abf3d2c6b6986193b00179fe734d117f6429c429281255e0093ced4d4831340ac73576f5e31cab586d1b6d779d00cc
SSDEEP 3072:oftffjmNwvJ9psmeIBcV8pQFq4XKF3QP6:4VfjmNw3psmeI+sQFqT3Qi
TLSH
T15F04071AD29802E8C06E6179C7968A41B3377C6593E1D3CB53D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 8B
SHA256 cb7bedc97bdd2d63203eb6ba133a1f2298106db82404f9055a36ff6d137d0f86
MD5 cdafaf40f18f1b84f5c564f8618a53c5
SHA1 d6778fe9d23f3cb9ae7b983cbced89febe0167f6
SHA512 e2d158d9d6e18a5ec5b381dd92d092ba4eafd77ace54370c53ad151f7f78120a3a27846510bf5dee427adf6415eba744e277b7955cd3398430c6ed2053c542b0
MD5 SHA1 SHA512

Submit Download

memory/4960-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-76-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-1229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-5-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-5026-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-5499-0x0000000000400000-0x0000000000434000-memory.dmp

Download