Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7 -
submitted
04-09-2020 19:47
Static task
static1
Behavioral task
behavioral1
Sample
Corporate_Detail-June.2020.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
Corporate_Detail-June.2020.bin.exe
Resource
win10v200722
General
-
Target
Corporate_Detail-June.2020.bin.exe
-
Size
1.3MB
-
MD5
6b083c1bfd21eea2a3f18283f1f3c5f5
-
SHA1
929b10f78565660535a07917d144d00b0c117571
-
SHA256
f2363a355fe226cb2f7f1afa72daecc5edfe1cb0edc1295856fb3f874d941b6d
-
SHA512
1ef2561ac5784bb90a1d39ab82f6f01122453bbe22cd55fa0a49aa534a7ece00c48b2bf1d31537e3fc5a447d1293bc23165c6a1fb00df2b3fda37a2eee62ee71
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\HACKED.txt
smaug
ttviper@secmail.pro
http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion
Signatures
-
Smaug
Ransomware-as-a-service first seen marketed on forums etc. in early 2020.
-
Drops file in Drivers directory 2 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Windows\System32\drivers\gmreadme.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Executes dropped EXE 1 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exepid process 2028 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Loads dropped DLL 3 IoCs
Processes:
Corporate_Detail-June.2020.bin.exepid process 1496 Corporate_Detail-June.2020.bin.exe 1496 Corporate_Detail-June.2020.bin.exe 1148 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
JavaScript code in executable 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe js \Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe js C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe js \Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe js -
Drops file in System32 directory 406 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc610u.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\icsxml\pppcfg.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\Enterprise\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO5H83L.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc5500t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp6500at.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\icsxml\osinfo.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc5100t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\_Default\ProfessionalN\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\icsxml\osinfo.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\eval\HomeBasicN\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Programs.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC3055F.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\hpmcpdp6.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\tsprint-PipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Recovery\ReAgent.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc7200t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\RacRules.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\OEM\EnterpriseN\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\_Default\Enterprise\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\migwiz\PostMigRes\Web\base_images\WindowsMovieMaker.bmp.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\wbem\xsl-mappings.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x5u.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\OEM\ProfessionalE\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\_Default\HomePremiumE\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO6200T.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smx8x3u.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\OEM\EnterpriseE\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\icsxml\ipcfg.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\winrm.cmd.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpb8300t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd7100t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpf4100t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumN\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5300t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpD5400t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\kop4650X.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\_Default\Ultimate\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj3500t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpf4400t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\tsmxuPipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prndrvr.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumN\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\EP0SBT00.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc8100t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\IME\IMEJP10\APPLETS\IMJPCLST.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\WCN\en-US\Add_a_device_or_computer_to_a_network_usb.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\restore\MachineGuid.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicE\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\tcpbidi.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1B83L.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpf2100t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\tsmxu003.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\en-US\prnjobs.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\OEM\UltimateE\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\en-US\Licenses\eval\HomeBasicE\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO3100T.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc6100t.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Drops file in Program Files directory 4749 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387578.JPG.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14565_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02097_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21319_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\HAMMER.WAV.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\ProPlusWW.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Simple.dotx.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14794_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\COUPLER.WAV.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN048.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RESUME.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099199.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10263_.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\WHOOSH.WAV.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SPACER.GIF.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.SG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN044.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\GRIPMASK.BMP.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Drops file in Windows directory 3469 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\flower.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-stacking_31bf3856ad364e35_6.1.7600.16385_none_d0d2b98d4629a41f\720_480shadow.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Performance.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Hardware Fail.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-audiodiagnostic_31bf3856ad364e35_6.1.7600.16385_none_1c7c64ad096a7b06\AudioRecordingDiagnostic.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows Hardware Fail.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\PLA\Rules\Rules.System.Wireless.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..isc-style-videowall_31bf3856ad364e35_6.1.7600.16385_none_f0f97c9a09073b00\203x8subpicture.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\timer_over.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp6.jpg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-festival_31bf3856ad364e35_6.1.7600.16385_none_121f20b55f0bde68\Windows Logon Sound.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_prnky003.inf_31bf3856ad364e35_6.1.7600.16385_none_3d4c795ded41268f\Amd64\kyw7qur2.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_methods.help.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Media\Raga\Windows Information Bar.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\buttonDown_On.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasctrs_31bf3856ad364e35_6.1.7600.16385_none_70130a6690196ee7\rasctrnm.h.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\winrm.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\HelpIcon_solid.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\DMR_48.jpg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..dthemes-calligraphy_31bf3856ad364e35_6.1.7600.16385_none_c1407bc73caf8dfc\Windows User Account Control.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile26.bmp.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\reveal_rest.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a47b34406ef9e8fc\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-stacking_31bf3856ad364e35_6.1.7600.16385_none_d0d2b98d4629a41f\NavigationLeft_ButtonGraphic.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Comparison_Operators.help.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Battery Low.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\potscfg.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\diagnostics\index\AudioRecordingDiagnostic.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\6.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Media\Landscape\Windows Notify.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_gray_thunderstorm.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_906259cc7eaff939\aspnet_perf.h.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_setup-uxwizard-clientimages_31bf3856ad364e35_6.1.7600.16385_none_48ada01d8ff36e68\background.bmp.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\Microsoft.PowerShell.Commands.Diagnostics.dll-Help.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Panther\diagerr.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\image1.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..dthemes-calligraphy_31bf3856ad364e35_6.1.7600.16385_none_c1407bc73caf8dfc\Windows Navigation Start.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-festival_31bf3856ad364e35_6.1.7600.16385_none_121f20b55f0bde68\Windows Battery Low.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_left_mouseout.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_en-us_dd050cebcad7bb4b\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Critical Stop.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Ding.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_aliases.help.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_bw48.bmp.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Media\Afternoon\Windows Ding.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Web\Wallpaper\Landscapes\img10.jpg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\connectionmanager_dmr.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-memories_31bf3856ad364e35_6.1.7600.16385_none_51190840a935f980\Title_mainImage-mask.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Navigation Start.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPO7200T.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\servicing\Sessions\30819263_4013383152.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\logo.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_en-us_5e6db46338f63db0\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1543c3c503d80bbc\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-travel_31bf3856ad364e35_6.1.7600.16385_none_f2a7c66510a5395d\16_9-frame-background.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..yle-specialoccasion_31bf3856ad364e35_6.1.7600.16385_none_01242a21ddccaf3b\SpecialNavigationRight_SelectionSubpicture.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_en-us_042d2c9052d53167\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\(144DPI)redStateIcon.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Report.System.Configuration.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\(144DPI)greenStateIcon.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows Error.wav.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\winsxs\amd64_prnky004.inf_31bf3856ad364e35_6.1.7600.16385_none_3dd58b93065f62f8\Amd64\KYW7QUR4.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Processes:
Corporate_Detail-June.2020.bin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main Corporate_Detail-June.2020.bin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Corporate_Detail-June.2020.bin.exepid process 1496 Corporate_Detail-June.2020.bin.exe 1496 Corporate_Detail-June.2020.bin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Corporate_Detail-June.2020.bin.exedescription pid process target process PID 1496 wrote to memory of 2028 1496 Corporate_Detail-June.2020.bin.exe 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe PID 1496 wrote to memory of 2028 1496 Corporate_Detail-June.2020.bin.exe 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe PID 1496 wrote to memory of 2028 1496 Corporate_Detail-June.2020.bin.exe 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Corporate_Detail-June.2020.bin.exe"C:\Users\Admin\AppData\Local\Temp\Corporate_Detail-June.2020.bin.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe"C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe
-
\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe
-
\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe
-
\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe
-
memory/1496-10-0x0000000005280000-0x00000000052A3000-memory.dmpFilesize
140KB
-
memory/1836-0-0x000007FEF6510000-0x000007FEF678A000-memory.dmpFilesize
2.5MB
-
memory/2028-8-0x0000000000000000-mapping.dmp
-
memory/2028-12-0x0000000000400000-0x00000000006A6000-memory.dmpFilesize
2.6MB
-
memory/2028-13-0x0000000000400000-0x00000000006A6000-memory.dmpFilesize
2.6MB
-
memory/2028-14-0x0000000000400000-0x00000000006A6000-memory.dmpFilesize
2.6MB