Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe
- Size 605KB
- Sample260824-mss7bsda65
- SHA256 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c
- MD5 2cfc9880c4653337528da0b284595043
- SHA1 456d6314e8445dee5e63430acbc8465d048aa8e1
- SHA512 e89e4ec0b6c414aa500db710c88d725347a1e495ddd9f1eb7cf5936c139870459469b2a7c05fdaee63f36b3bb11d2dc9a249cc7865e3c3a9173e17a9c91e6a7d
- SSDEEP 12288:bji05ji05ji05ji05ji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:iLLLLLeuTewuIjmH8j4J4od
- TLSH T1CCD4BF10FBD5C136EAA3273144F587AE5A7ABC649B30DACBA354076D9CA03C1EC35726
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 1344 Logo1_.exe 5788 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 4296 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 2900 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 4992 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 4688 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 5524 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\Visualizations\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\_desktop.ini Logo1_.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe File created C:\Windows\Logo1_.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe File created C:\Windows\Logo1_.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe File created C:\Windows\Logo1_.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe File created C:\Windows\Logo1_.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Logo1_.exe 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe - Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5052 cmd.exe 4372 cmd.exe 5536 cmd.exe 4644 cmd.exe 4340 cmd.exe 5016 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1364 1344 WerFault.exe 90 - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe 1344 Logo1_.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1612 wrote to memory of 4340 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 89 PID 1612 wrote to memory of 1344 1612 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 90 PID 1344 wrote to memory of 1172 1344 Logo1_.exe 91 PID 1172 wrote to memory of 1260 1172 net.exe 93 PID 4340 wrote to memory of 5788 4340 cmd.exe 95 PID 5788 wrote to memory of 5016 5788 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 96 PID 5016 wrote to memory of 4296 5016 cmd.exe 98 PID 4296 wrote to memory of 5052 4296 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 99 PID 5052 wrote to memory of 2900 5052 cmd.exe 101 PID 2900 wrote to memory of 4372 2900 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 102 PID 4372 wrote to memory of 4992 4372 cmd.exe 104 PID 4992 wrote to memory of 5536 4992 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 105 PID 5536 wrote to memory of 4688 5536 cmd.exe 107 PID 4688 wrote to memory of 4644 4688 09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe 108 PID 4644 wrote to memory of 5524 4644 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a549E.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5663.bat8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a572E.bat10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57CB.bat12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 9923⤵
- Program crash
PID:1364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1344 -ip 13441⤵PID:5276
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
- Size 722B
- SHA256 de39335068f5fa480c16121d34077a02394322eea7324f4182833b275496d078
- MD5 2d60d252fa9d3d853c9351c037470d8d
- SHA1 b59fbba3f04500062f374d33f1fa4a87ee64764e
- SHA512 17dcf1252e34c3581ff7801f7fe701c342e0a79a93936a1691428f33305d19e8ebaa040c9b0e05f8e56930b5694d9830ccc20cdd15d8d73cd547289b99b3dc66
- TLSH T192012491819B47063CA4050EC6E6B4DEB12E44DEAE807E53612BC40C62C4F6FBEAEA11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a549E.bat
- Size 722B
- SHA256 de8fc192ada32f35d7941b7ec4c30ecc0dcd57335224f716d1ca3c4c86074d2a
- MD5 18a41b91d0cad9bb2b94c462adf25c68
- SHA1 c89151e31abff92a6cfa6b949e16f4a1e3818959
- SHA512 36ebcd00d65ac98b6a4582fb6c0ef4515f11dcc2f33fa8e7a5c8e34d043beb1c826fcb79bcbf126df8a2a198e0ad6e6484e4581793ddc96c27fc715eac1a63a8
- TLSH T12E012491819B47063CA4050EC6E6B4DEB12E54DFAE807E53612BC40C62C4F6FBFAEA11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
- Size 722B
- SHA256 0bcfd73f38771ff8665d09cce8836e80196a320b504f380fd06f64109d134328
- MD5 146c0e12fdbc53b30c0856e0f06b1a6a
- SHA1 89b5f8fd5d60804fab1209bee60c08958fef9e30
- SHA512 376f9d3fbf0cc850c98889d24dc85b428bae1c830bccfa6e3714c87f196a44cd12ce87de5afb5b81a5ae6f4eb3b07a80ddba68c0a8ea8632153b614c430c1ee3
- TLSH T15A012851819B47063CA4050EC5E6B4DEB12E44DEAE807E53512BC40C62C4F6FBE9EA11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5663.bat
- Size 722B
- SHA256 8d2311ef8cc79c4e8c4332e14cf01536230fc31852ab93eb0ed45b54418a0e8a
- MD5 e85de8506b5e1c8c6fbb722aed3f9037
- SHA1 abc4c83ccebbe757581df1bafc6354bfd9ecf3d6
- SHA512 ee4ee797c3776326f9f2a9541f13db29536bcccf72fdcf710848eaeb646e6970c1a8855183d6171f99e9cf110fb70c9085900584c3cf1cc6d71e4f10a366ffef
- TLSH T178012491819B47063CA4050EC6E6B4DEB12E54DEAE807E53612FC41C62C4F6FBEAEA11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
- Size 722B
- SHA256 a1a200cbc0ccd18baccf3a8a40ef66203e792339bc5d734a607001af740b7705
- MD5 13192307450e1559e157d0fae02686ed
- SHA1 b4c081b87f827c43743be63587dec0ace8032e76
- SHA512 4019a15da234f86cf71be6992255f2d0c014e76be57fb41527f78453e9b88e078afb350436ab3564d09540bb9ac0874e3c9cbb7877f3c81e7c03d1dda727a672
- TLSH T1EC012491819B47063CA4050EC6E6B4DEB12E44DEAE807E53612BC40C62C4F6FBEAEA11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a57CB.bat
- Size 722B
- SHA256 dd9c28dcff4ff2da86ee4912a9c538dd69638f7ad5645da08a218a5c5138989c
- MD5 e68501afae311367bef1053b0ad46035
- SHA1 e40b2aa0f48cd44c976063aa7c9a65a8205127df
- SHA512 9cf8c11956a8d969d9f45c416200d99028cc6d7f58720694fd367ff31836c9ee671d526a15a682d4b3fc79513f1c86da7c1546780bf14ad7045d3fe9bd465ef4
- TLSH T1B7012491819B47063CA4050EC6E6B4DEB12E44DEAE807E53612BC40C62C4F6FBEAEA11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe.exe
- Size 572KB
- SHA256 8a5f8140d95404bd233bb58db521d7671ad62b72806020857a3a3871ebd0f969
- MD5 c43bf8595c7b5705e9b49b42134ce622
- SHA1 ec9cdfd8bcbf168f2223fadd79931793571d44aa
- SHA512 a59c251f42e05e899807d95f478689bd6f366e4e2f65665955531e6c2b3552f23d5ecf85d3a3adcf895df1b930352843692434c6c84f0d7a4335fdfe0d9f79b7
- SSDEEP 12288:bji05ji05ji05ji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:iLLLLeuTewuIjmH8j4J4od
- TLSH T13DC4AF10FBD5C136EAA3273548F587AE5A7ABC649B30DACBA354076D9C603C1EC35326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe.exe
- Size 539KB
- SHA256 6e4f983c688263f4689ff4e2342633e46623534cf5a73392180da2912e758775
- MD5 1e26f72459b4393946cbce86efc838e2
- SHA1 0c589266be59d142ee9b1d78851d47cc53a203cf
- SHA512 0ca04dcac60f4aa27f7b343d9655d0f71f5cfb4d02b166c6127dc3c2177ae4bb0c0dd63f035313513ad73d77397800d5c599c16d3b3a2d50b04b39081511e97e
- SSDEEP 12288:bji05ji05ji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:iLLLeuTewuIjmH8j4J4od
- TLSH T13BC4AE10FBD5C136EAA3273548F487AE5A7ABC649B30DACBA354076D9C707C1E835326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe.exe
- Size 506KB
- SHA256 98532f160d798f4978f6e18ee8d46f7d5679ff88ccce64463d901aa534a1c152
- MD5 2a638d465c8ca545f4637cda21ee8a0d
- SHA1 12346047f9ae6f896f438a42e97b61f18d004607
- SHA512 af2b9e6daeadc6e75038936b1fdb92237736ebd9edfab567558d4e7c0ec1086893e4a966ca033cbdfa5bb956c62a64d82e731ddee169ac4de19947157c740d4f
- SSDEEP 12288:bji05ji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:iLLeuTewuIjmH8j4J4od
- TLSH T16FB49E10FBD5C136EAA3273558F487AE5A7ABC649B30DACBA354071E9C707C1E835326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe.exe
- Size 473KB
- SHA256 cf6c212897d654c50ff76a9d9659b775e77c82a1ce0b6b524b8e522d289fa75d
- MD5 1edc8aa67a8c3f20ff8b79541f423044
- SHA1 56f90a3b0ec29cd5b41d6e48190c5b7881832c22
- SHA512 c5bf5812b56381135d486da99e1f50711df2868d6c6b8f5315b480f00fd7cde72f05c60c2d1a9fd41a81ace4d1fa97b3433cb410ae55f2525ef78eba02ffa89e
- SSDEEP 12288:bji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:iLeuTewuIjmH8j4J4od
- TLSH T1B1A49E10FBD5C136EAA3273558F487AE5A7ABC649B30DACB6354071E9C707C2E835326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe.exe
- Size 440KB
- SHA256 9ffcf91d9fc1d1ba631726bcfd78b4773173a04acea0a740f89c66166d3a8286
- MD5 02ac7c43c4885bad923bec0ab8b23381
- SHA1 961b6dbf01d457ab7b066607c6113e786f74d231
- SHA512 e9db9d59b98819b44aeb188e86aeabdd6977d98c24505c4bb92fa55615552878f882d99753db77183c239e3277668e9799e701900174c32b5d2a016750e83dfc
- SSDEEP 12288:bji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:ieuTewuIjmH8j4J4od
- TLSH T19DA48D10FBD5C136EAA7273548F487AE5A7ABC649B30DACB6354071E9C707C2E835326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\09f5fe731c3723b350c6feaaedee43a214d9652f8ccad5127f82c3fd8f7feb2c.exe.exe
- Size 407KB
- SHA256 32d1f0b45fa9e9c1d2a8a02911bdc770b066a4378e66314c9dfc3c7a87abe143
- MD5 cf46da28f8c8bf9bfe8a10384d44e3ee
- SHA1 e44ca3ab7285da8d76dd7731fc4a2a78edc0282a
- SHA512 142a3db99f72d1083aff128c19eefc32b74d707e6ba4807d7585e27f006bbab044060835dcb1c685aa361e61088441cfbed4ab95fab1d8d011722887b30df4d2
- SSDEEP 12288:Tu++ewurRujFy1HLhyKyVkKB0HaOKTcF5T:TuTewuIjmH8j4J4od
- TLSH T1AA948D10BBD5C136EAA7373658F487AE597ABC645B30DACB63440B1E9C707C2E835326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 32KB
- SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
- MD5 4f07b7c07db3deeaef154a2f2c9646b0
- SHA1 6ada698575fd2ce3b8041f85d04dad5bd846a03f
- SHA512 35d71140bddbe016fe55a1e9328b3d284b3c9d5ebe9225b062b994bff4c70555fdf81378a299ab70f1c4d37b60a18a5f8a411e63fe4562299863bb1378616a90
- SSDEEP 768:bblN1dkT2ljlL5b+n8WF6mucTrVwp6NS3w0n:bJZ/j95b+n8wKcTI6
- TLSH T10CE2E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-3989226554-2204910950-1522900112-1000\_desktop.ini
- Size 9B
- SHA256 e07dae18d1c9e3faccd99072147b44802c3ffbcefa92d8d8654aae300bb90ea1
- MD5 850eb823eee2ce797df21707e6b85aa0
- SHA1 31b4732d09d96a871d0e41c96794a2a56b416220
- SHA512 db614e00c73f8d5ca58c5375dccadc0234097d0681533ff1624923a667cfb642098481f9e7bdee9db85c93f658216a7f854cfcce526f2d792eeb9e4a14932546
- MD5 SHA1 SHA512