Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
General
-
Target
b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe
-
Size
564KB
-
MD5
63596dde05919736cdfaf9bd4f018610
-
SHA1
9fd8673659b8f3776e469dc1fd21c2ab0d70f41e
-
SHA256
b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec
-
SHA512
d92e423c6d60bbc0ad6fe13a8f9d2b26921a38dbbd07bfdba7a12af8e6bdd5cdce567759fcb6256014a0f5f0d7bf063e3528a695fe2d0f6ef95fabc94647e65b
-
SSDEEP
6144:13mdMT5hiT1A9aAQST5I6FcLBS50lVQR/8Ug:tBTW5fAQSNziFVg/
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\E: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\M: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\Q: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\N: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\P: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\V: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\X: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\I: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\J: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\L: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\H: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\S: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\Y: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\Z: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\B: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\F: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\G: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\T: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\U: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\W: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\A: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\K: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened (read-only) \??\O: b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\logagent.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\setx.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\user.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\migwiz\MigSetup.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\wininit.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\LocationNotifications.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\psr.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\convert.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\ntoskrnl.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\Dism.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\efsui.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\recover.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\subst.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\control.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\cacls.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\label.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\autochk.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\cipher.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\runonce.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\diskraid.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\expand.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\msdt.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Windows Mail\wab.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7601.17514_none_7f7f66788318015d\lpremove.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\wowreg32.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXWiz.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63_auditpol.exe_83c870f4 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_7da9291f2ec46948\dpapimig.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_f06adab455a2f1e9\WMPDMC.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.1.7601.17514_none_555ae6d66ee2630d\snmp.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_40d0db63344deff9\SystemPropertiesHardware.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\ditrace.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..tomizationsnonwinpe_31bf3856ad364e35_6.1.7601.17514_none_29f4eed2a5d64c25\PnPUnattend.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\quser.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724_splwow64.exe_74753166 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_3.5.7600.16385_none_8c3cf176a8e91487\MSBuild.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_c25bebf1075ff6aa\OptionalFeatures.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-deployment_31bf3856ad364e35_6.1.7601.17514_none_fdf660b64b901b2e\setupugc.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_5b9fee911dc04044\eudcedit.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\shrpubw.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_a1802b822e2a878c\WMIC.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_6.1.7601.17514_none_c3b917fd89d834f3\LogonUI.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpresult.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_626b9352dcfa715c\ComputerDefaults.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb\hh.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\setup_wm.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81\iscsicli.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\twunk_32.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_2d02b12c3d47a517\sidebar.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCPROP.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\user.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_c0aa8bc2de239cf9\wevtutil.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-fontview_31bf3856ad364e35_6.1.7600.16385_none_443a636317ca9b75\fontview.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\wabmig.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_installutil_b03f5f7f11d50a3a_6.1.7601.17514_none_0826be6cc9481df4\InstallUtil.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7600.16385_none_6425238b793ee910\PDMSetup.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_a03d6846a99c1c87\iecleanup.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnscacheugc.exe_aa32623e b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_ba1c770af0b2031b\cvtres.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\shrpubw.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a_ndadmin.exe_8e57269f b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_6.1.7601.17514_none_f73c142da6e47daa\dfrgui.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_f4285a06060032a9\vbc.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_6.1.7600.16385_none_78e75d04c1b0c873\fvenotify.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_0d44b8d3df1c79a9\imjpuexc.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.1.7600.16385_none_44d62330646f757a\DeviceEject.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\relog.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_regasm_b03f5f7f11d50a3a_6.1.7601.17514_none_a3c349b4bdac0898\RegAsm.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_0f797e18d8361ef2\cttune.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_6.1.7601.17514_none_301a46c726a4cdc6\repair-bde.exe b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dialer\ = "dialer.chm" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\InprocHandler32 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dialer b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document\ = "PhoneDialer Document" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3} b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\ = "PhoneDialer Document" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document\CLSID b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B2FFDC~1.EXE" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\LocalServer32 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\ProgID b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\ProgID\ = "PhoneDialer.Document" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\InprocHandler32\ = "ole32.dll" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document\CLSID\ = "{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}" b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe 1912 b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe"C:\Users\Admin\AppData\Local\Temp\b2ffdcb6d873e3e8d51fb2920d5b1879262950b4ce347cc59eb90aacfa57cbec.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1912