Analysis
-
max time kernel
152s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe
-
Size
436KB
-
MD5
695be716230e99d3d7a7ffb83e365d30
-
SHA1
eff3256cdb42f082124c43b9bca10cabd43a84ce
-
SHA256
09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1
-
SHA512
8feb80b07badbb8a7b6205bc2e5cf2a9644dc937db4844fd8683c4ba146a8aa8f2e49362e4994e6a3cfc52e10743bebad0e0118e6261e72950555e344ad1caae
-
SSDEEP
6144:cCNbLqcVTpwikcpFaTIdoYuqmO5MpOumHhwTt:c2LzVTpwr2t/uqmO5MpOumBwTt
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened (read-only) \??\A: 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\curl.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\dialer.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\winrs.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\certreq.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\label.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\secinit.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\comp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\replace.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\ftp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\provlaunch.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\regini.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\autochk.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\control.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\PING.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\MicrosoftEdgeComRegisterShellARM64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\MicrosoftEdgeUpdateBroker.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\MicrosoftEdgeUpdateOnDemand.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_aadf84cda75da02d\aspnet_regsql.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\hnsdiag.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvix64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\explorer.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvax64.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\f\SpeechRuntime.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15805.0_none_d67d06ef0c4a2e1c\InstallUtil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\f\vmms.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\r\conhost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\f\directxdatabaseupdater.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\r\IcsEntitlementHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\vmms.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.19041.1_none_39d506065bd87607\vmsp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_e190f18a08ed1a44\FlashUtil_ActiveX.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\GameBarPresenceWriter.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\n\VmComputeAgent.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\r\nvspinfo.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_c6dc1994db088235\CasPol.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\r\directxdatabaseupdater.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\f\vmcompute.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\r\vmms.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\f\vmwp.exe 09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe"C:\Users\Admin\AppData\Local\Temp\09dd5e5c8944a0a7a6b069cd16e46a706852f3123be679ca332a7754553945d1.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1952