IOC Report
LADMAutoInstallService.exe.7z

loading gif

Files

File Path
Type
Category
Malicious
LADMAutoInstallService.exe.7z
7-zip archive data, version 0.4
initial sample
malicious
C:\Program Files (x86)\UDCCLauncher\UDCC Launcher\UDCC Launcher.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Program Files (x86)\UDCCLauncher\UDCC Launcher\UiLib_d_x64.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Program Files (x86)\UDCCLauncher\UDCC Launcher\config.ini
ASCII text, with CRLF line terminators
dropped
C:\Program Files (x86)\UDCCLauncher\Version.txt
ASCII text, with CR line terminators
dropped
C:\Program Files (x86)\UDCCLauncher\udcc_launcher.zip
Zip archive data, at least v1.0 to extract, compression method=store
modified
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5kucntzj.kt5.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\Desktop\LADMAutoInstallService.exe\LADMAutoInstallService.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
JSON data
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped
There are 3 hidden files, click here to show them.

Domains

Name
IP
Malicious
t-9999.t-msedge.net
13.107.213.254
download.lenovo.com
unknown

IPs

IP
Domain
Country
Malicious
23.212.88.224
unknown
United States
184.28.90.27
unknown
United States
40.126.32.72
unknown
United States
127.0.0.1
unknown
unknown