7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
Size 26KB
Sample260822-t4rafafe96
SHA256 7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e
MD5 9c932503726e484fe678d7e833335d64
SHA1 dc810d3887f6f8761c2b1e800b3b94cd1a37ab01
SHA512 56837b129fb317a34a6bf23feadb03299eeed68834ce2f0a5893206b57a69682d3393677539eeff7580b6e3616dee51acfad5243179cca045a1a7fb6c05b2af8
SSDEEP 768:fMb1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:f4fgLdQAQfcfymN
TLSH
T1FFC2D07616CB2535EC26497CDBE62702833E0F7A409F946535E3693E2264BEA214EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\N:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\Z:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\U:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\S:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\P:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\L:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\K:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\J:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\G:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\Y:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\V:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\T:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\O:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\I:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\X:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\Q:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\M:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\H:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\D:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened (read-only)	\??\W:	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\GoogleUpdater\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2100	916	7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe	89
PID 2100 wrote to memory of 5460	2100	net.exe	91

C:\Users\Admin\AppData\Local\Temp\7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe
"C:\Users\Admin\AppData\Local\Temp\7e9ee6c1404267ce262d4136078ea2dec90ac37330e4fed082ebf90345f9335e.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 598a22fd40625925206da60c0dd4c6f674c54543a709f3feae6e2e43de7e68cf
MD5 7abea4e2ffb32e6eafedd8a5206a7521
SHA1 8d8ee0960b0f6478d0637ce8338ed810e995a87d
SHA512 a98084e3b52ad959b2cadc72463361d3eb229c05ef77b3d6b5cb2ce3651fd27aeac78db397768d082168a9354319be1d9676dc757ddb820119a7299cbe4da712
SSDEEP 3072:JftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:hVfjmN2G7/fYfLvzB+QFyn
TLSH
T1A1C38C1371D18871E9B20C3449A1EA619E3FFD620B449EA733C4667E0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 170KB
SHA256 654f08c1bb3e8ce9925bdaebb8e218bc978dc786ca5fc218901d17cc36f95418
MD5 a0e6ffecb02be6131dc203f44dc9c5f3
SHA1 3d671b375f3f429c269f28a109a86b9bec7c4280
SHA512 8f1dc4c54c047d6f7f3b54b72bf5c76c4587c38bc29d66d6edbfe5eb7cf6fe23becaefcd8d05eb6fc1518a4c24594e247a9de8696362cce4ae7c2a4f8ea8d46b
SSDEEP 3072:AftffjmNwvJ9psmeIBcV8pQFq4XKF3QP6:AVfjmNw3psmeI+sQFqT3Qi
TLSH
T13004061AD29802E8D46E6179C7968A41B3377C6583E1D3CB13D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\_desktop.ini
Size 9B
SHA256 d4d8f9f80b18a46f97a66d9f2276d6028cc30bdd0122ba5302395833bc4f3fd8
MD5 99ca47efae47d2362f276c374dddbf13
SHA1 728da071b74901391e1f7e8f2bd686388c3694e4
SHA512 6a6fe7d79b1ae030725f639ed96671f8b688b3857048a87a3be5c7aab8d374c868f9e459e7323b457649773726867b430c5e7ce0fa752befb772e4ebdd2410d5
MD5 SHA1 SHA512

Submit Download

memory/916-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-64-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-1229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-5-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-5026-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/916-5499-0x0000000000400000-0x0000000000434000-memory.dmp

Download