d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
Size 26KB
Sample260816-pcd4ksxcqa
SHA256 d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8
MD5 082b17bbe921e2b951b305425c7c44b9
SHA1 1d0efb835aec7593039d7803a9d7b6bb9e151454
SHA512 d86212b6b542b4457f04d236201b585b77218048e6d3b826c7dfe578b3eedecb55fbfd7107ef5d80760d89fca9277192d99db32f08703dcb16aac1a6439368fe
SSDEEP 768:gAppp1ODKAaDMG8H92RwZNQSw+JnbmQj3FZJ9VfjWCk:bpp/fgLdQAQfwt7FZJ9ZX
TLSH
T134C2E04F27E3E931C9289EBC0E731B5296305F395A7E00272073F92A0774DC52C96AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\S:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\P:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\I:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\H:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\G:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\O:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\N:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\Y:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\Q:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\L:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\K:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\U:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\R:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\J:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\D:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\M:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\Z:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\X:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\W:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened (read-only)	\??\V:	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win11\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5072	4388	d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe	89
PID 5072 wrote to memory of 4104	5072	net.exe	91

C:\Users\Admin\AppData\Local\Temp\d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe
"C:\Users\Admin\AppData\Local\Temp\d60742d7c87b64c6cf9515999b6bf73fd79f2b01577f88490b973afbeecfa2f8.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 c3787804cbb53b890800ab8a6057838a4206f9ec4c9c292a9786d33193a8294c
MD5 6817e218a592698c95e02065409ae42d
SHA1 329c2b810fa41a91556320bbe6f7527c175a1ee3
SHA512 6552ff29a00fccc4e670949668a54b0f9798b30cf632e42cc2bf627e3b08115504dac1ad20769cbff65379ed38ac45a6e307c0d648711d48b749bee9568ea8ad
SSDEEP 3072:zpp/ftffepVZuhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:VpnVfgiG7/fYfLvzB+QFyn
TLSH
T118C38C1372D1C861E5B10C3449A1EEA19D3FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 170KB
SHA256 1779ba98ecc83579db5cce2e2c84cf00a8addb655a8491f22dc91cd0b0f847f0
MD5 f8d085e6284c8d1a473d50643df198d4
SHA1 b6c26377716bd4fb3b27d83fcbb0b1ac236528ab
SHA512 f9e826502a70237cd024b43e51225bbad886603c4c75906add12b3947830241b8f253357e23a04f91b2fb60ce94320a6bb789d202e4fb522f07fed9803044c9f
SSDEEP 3072:bpp/ftffepVZivJ9psmeIBcV8pQFq4XKF3QP6:9pnVfgc3psmeI+sQFqT3Qi
TLSH
T19104060AD29802E8C06E6279C7564A41B7337C6587E1D3CB53D0F53E1F76680AEEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 ac6e4075d0fde963eefff0588ab5a461637001617cda0297752cc83a5fb10a78
MD5 cb44f6dfc682c5e6b04331c84dc62e52
SHA1 9ee96fa8cd28b70e2fa75d408ddcc1b516421d40
SHA512 5ce2217f16875bef447433c91d01f192ee5be43aad0c4e0f8f926ba5122663013dbdd03303f9b493d89c5d221138676fff713515034bfc19c0022c5c4009e818
SSDEEP 12288:2pYtqIOkU8AMXE9B7PElZlP41N+4PUWfo:+wBOkUhMXcBwc04nA
TLSH
T1E4A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3986082593-3624157295-3514260330-1000\_desktop.ini
Size 9B
SHA256 594042b32eb4f8ff7b253fc3947dc478c67ecc9f4347f76d02edc6d6108f473e
MD5 ec0a9a97b5a49b6c34d3f7ead44ce575
SHA1 fee2b64e68a91eaf252ffa2a0bafe48851624e47
SHA512 d67eae1b768c1aea1885b7599d5fa7c70028cb6c7a1009ad753b8d97d84966cab014ee84975e862f4fb14e95a1ea7035d7168a22e4cdd792527861e81fb8a491
MD5 SHA1 SHA512

Submit Download

memory/4388-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-74-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-1229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-5-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-5026-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4388-5499-0x0000000000400000-0x0000000000434000-memory.dmp

Download