Analysis
-
max time kernel
149s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe
-
Size
436KB
-
MD5
695be716230e99d3d7a7ffb83e365d30
-
SHA1
eff3256cdb42f082124c43b9bca10cabd43a84ce
-
SHA256
09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1
-
SHA512
8feb80b07badbb8a7b6205bc2e5cf2a9644dc937db4844fd8683c4ba146a8aa8f2e49362e4994e6a3cfc52e10743bebad0e0118e6261e72950555e344ad1caae
-
SSDEEP
6144:cCNbLqcVTpwikcpFaTIdoYuqmO5MpOumHhwTt:c2LzVTpwr2t/uqmO5MpOumBwTt
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened (read-only) \??\B: 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\verifier.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\choice.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\print.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\diantz.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\calc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\setup16.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\sethc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\dccw.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\SetIEInstalledDate.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wininit.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ntkrnlpa.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\help.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\winver.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\vssadmin.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_31db018394805d6b\TSTheme.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vdsldr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_04846decebf43c4c\perfmon.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_090b7101bec9a9e2\cipher.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00\mpnotify.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_6.1.7600.16385_none_9db1ae483049e160\EhStorAuthn.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_698e475b97512fc9\PushPrinterConnections.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..g-xpsdocumentwriter_31bf3856ad364e35_6.1.7601.17514_none_80fea45979a5d3f2\MxdwGc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_1f3413afc64d10c5\wuauclt.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_cb3bc16fc2624947\rasphone.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\setupsqm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_ca00459dda59f6f4\netiougc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e\expand.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-grpconv_31bf3856ad364e35_6.1.7600.16385_none_fe7d1685575edfa6\grpconv.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_c80d81c947c7b794\HelpPane.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_6.1.7600.16385_none_47357ddedbb9dec6\logagent.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmpshare.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7601.17514_none_7f7f66788318015d\lpremove.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_cb0f7f2289b0c21a\notepad.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_b9c82ac6f7db99ae\where.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_12466fe3b629e036\winver.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7601.17514_none_5e47617f33c574ac\SMConfigInstaller.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-calc_31bf3856ad364e35_6.1.7600.16385_none_05b2f2e2346cfea4\calc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\WFS.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-wizard_31bf3856ad364e35_6.1.7600.16385_none_7680aa7b6195f2c6\DVDMaker.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sysprep_31bf3856ad364e35_6.1.7600.16385_none_4b73926c122be805\sysprep.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_32c4b0bc55387f75\psr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_6.1.7601.17514_none_bf7bea0454c3f0cf\bcdboot.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_6.1.7600.16385_none_e47ee9c51ad9df17\ktmutil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmEngine.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidpolicyconverter.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\rrinstaller.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_934d08d31b96d4ee\sdchange.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\instnm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_99424f610bd169de\control.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce\bridgeunattend.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d\printui.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\comp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_46d2efef53c02386\wextract.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\WinMail.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgport.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_ddef5417d55eb944\aspnet_regbrowsers.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcalua.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_696354579779eadf\imjpuexc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-netcfg_31bf3856ad364e35_6.1.7600.16385_none_6c23cd5f6b2a8dbc\netcfg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\splwow64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qappsrv.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-edmgen_31bf3856ad364e35_6.1.7601.17514_none_0ca1fd81527e1e9a\EdmGen.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_9e59e11166b683d3\PDIALOG.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe"C:\Users\Admin\AppData\Local\Temp\09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:900