Analysis
-
max time kernel
147s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 15:40
Static task
static1
Behavioral task
behavioral1
Sample
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe
Resource
win7-20220812-en
General
-
Target
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe
-
Size
3.7MB
-
MD5
66000c5f4ab1a3e0581b82c7ec037eda
-
SHA1
266a7e51ac3ee8b5d73e19461a226a3dae5f5627
-
SHA256
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e
-
SHA512
77ad229bc5db67a918db715a843ae5b14bb0547cf010cc7e56f70b89d5c3aac411590b9261440fd1db41a6f37788716fc0fe3a91c51e429a3b517b676e354ea8
-
SSDEEP
49152:XGkO/hDNTa/UhqNl8vLvwUQfsypLSvcnkKs0ByZq8gbfwTCEf5AMQBvPngksT68k:XGk/UYNl8zvwUQfsypOvT0Y8RjYM8u9
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Drops startup file 2 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\UltimateE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO0410T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW0460T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Commands.Management.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\System.Management.Automation.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5300t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO1500T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\migwiz\PostMigRes\data\HardwareVendors.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\RacRules.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\Starter\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO7300T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1000T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7500t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\Ultimate\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj5500t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Commands.Diagnostics.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5100t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj3500t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj3600t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO6200T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\Microsoft.PowerShell.Commands.Management.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5060t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW9800T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa620t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4200t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\Enterprise\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WCN\es-ES\Add_a_device_or_computer_to_a_network_usb.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7300t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1200T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Security.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd1500t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremium\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\Microsoft.PowerShell.Commands.Utility.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\Microsoft.PowerShell.ConsoleHost.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO5600T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateE\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj6400t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPP8200T.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\Microsoft.PowerShell.Security.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\Ultimate\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc7200t.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\wsmanconfig_schema.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalN\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\lipeula.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\en-US\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Drops file in Program Files directory 64 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\Content.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\BackupCopy.docx 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\ProPlusWW.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABOFF.JPG 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImages.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Drops file in Windows directory 64 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_de-de_34a4f72aa1dd0bf7\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7fa92a4e1adcf67f\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d4f8a2f961a0e7e4\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_es-es_fe5ae984a243eda3\lpeula.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp4.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a5f3b7a6a481da29\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..l-starter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0cd2728ca2c96dff\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\wow64_microsoft.windows.d..ackmodule.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_efb94357062c4429\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp3.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Pine_Lumber.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_es-es_53d92c4ec2b28e59\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_en-us_75584897d00dd323\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Web\Wallpaper\Architecture\img13.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\diagnostics\index\NetworkDiagnostics_2_FileShare.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_es-es_eb07b84d53fabc90\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_27607ce0d66d59f6\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-d..characterlistapplet_31bf3856ad364e35_6.1.7600.16385_none_8149342acd294792\IMJPCLST.XML 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dd95cd2390bb17bc\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Koala.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\pppcfg.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp2.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a479cd0719d5814b\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_en-us_fe8f8ca0a21cfbfe\lpeula.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\potscfg.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\diagnostics\index\PowerDiagnostic.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\img22.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_de-de_119b79ee0275a321\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img6.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_17db1b7ac306db2a\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipscht.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fa282a13eee96e21\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e95c981dae99ae46\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_5120bf8b19591afa\PCWDiagnostic.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\diagnostics\index\PrinterDiagnostic.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_it-it_8b3a55ca6c47e983\lipeula.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_de-de_dd27dc7caf015a96\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..m-starter.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_be24152864a354e5\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2867d8179890f1a8\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\GlobalInstallOrder.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_99a20a91fbb28e1c\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ee871b8ab496c12c\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_it-it_09649fda8ac09f8d\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp4.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_it-it_da156c29d2de7a95\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_c985fbedc9886bd1\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_61da96604705f464\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_de-de_8d33546de1c5ef03\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_39fac466966dd4f8\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5e03773a5199eaf2\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_2d5fd4d75f62fb5e\lpeula.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\ea.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_a1125f8395160405\lpeula.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v2.0.50727\RedistList\FrameworkList.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d93f349420c7d013\gadget.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Sand_Paper.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018\0bada1de-01a9-4625-8278-69e735f39dd2.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\diagnostics\index\NetworkDiagnostics_5_Inbound.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\wow64_microsoft.windows.d..ackmodule.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0e8fb2048e644c9\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp5.jpg 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_de-de_d3c900b7d1b7a643\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_en-us_71625f48bc357cf2\license.rtf 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\base.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification \??\c:\Windows\diagnostics\index\PerformanceDiagnostic.xml 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Modifies registry class 5 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5}\ = "XWizard Factory Generated Class (HomeGroup Update Passkey/Merge Hook Page)" 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5}\InProcServer32 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5}\InProcServer32\ = "%SystemRoot%\\SysWow64\\xwizards.dll" 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5}\InProcServer32\ThreadingModel = "Apartment" 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5} 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription pid process Token: 33 2012 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Token: SeIncBasePriorityPrivilege 2012 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Token: 33 2012 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Token: SeIncBasePriorityPrivilege 2012 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription pid process target process PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 2028 wrote to memory of 2012 2028 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"2⤵
- Checks BIOS information in registry
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-106-0x0000000000415000-0x0000000000416000-memory.dmpFilesize
4KB
-
memory/2012-87-0x000000000040B000-0x000000000040C000-memory.dmpFilesize
4KB
-
memory/2012-60-0x0000000002730000-0x0000000002934000-memory.dmpFilesize
2.0MB
-
memory/2012-66-0x0000000002730000-0x0000000002934000-memory.dmpFilesize
2.0MB
-
memory/2012-67-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/2012-55-0x0000000000000000-mapping.dmp
-
memory/2012-69-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/2012-81-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB
-
memory/2012-82-0x0000000000407000-0x0000000000408000-memory.dmpFilesize
4KB
-
memory/2012-83-0x0000000000411000-0x0000000000412000-memory.dmpFilesize
4KB
-
memory/2012-84-0x000000000040D000-0x000000000040E000-memory.dmpFilesize
4KB
-
memory/2012-85-0x0000000000402000-0x0000000000403000-memory.dmpFilesize
4KB
-
memory/2012-86-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/2012-107-0x0000000000443000-0x0000000000444000-memory.dmpFilesize
4KB
-
memory/2012-88-0x0000000000408000-0x0000000000409000-memory.dmpFilesize
4KB
-
memory/2012-89-0x000000000040E000-0x000000000040F000-memory.dmpFilesize
4KB
-
memory/2012-91-0x000000000040F000-0x0000000000410000-memory.dmpFilesize
4KB
-
memory/2012-90-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/2012-92-0x000000000041B000-0x000000000041C000-memory.dmpFilesize
4KB
-
memory/2012-93-0x0000000000419000-0x000000000041A000-memory.dmpFilesize
4KB
-
memory/2012-94-0x0000000000413000-0x0000000000414000-memory.dmpFilesize
4KB
-
memory/2012-95-0x0000000000412000-0x0000000000413000-memory.dmpFilesize
4KB
-
memory/2012-97-0x0000000000424000-0x0000000000425000-memory.dmpFilesize
4KB
-
memory/2012-96-0x0000000000414000-0x0000000000415000-memory.dmpFilesize
4KB
-
memory/2012-98-0x0000000000426000-0x0000000000427000-memory.dmpFilesize
4KB
-
memory/2012-108-0x0000000000427000-0x0000000000428000-memory.dmpFilesize
4KB
-
memory/2012-100-0x000000000041E000-0x000000000041F000-memory.dmpFilesize
4KB
-
memory/2012-101-0x000000000041F000-0x0000000000420000-memory.dmpFilesize
4KB
-
memory/2012-102-0x000000000041C000-0x000000000041D000-memory.dmpFilesize
4KB
-
memory/2012-103-0x0000000000442000-0x0000000000443000-memory.dmpFilesize
4KB
-
memory/2012-104-0x0000000000448000-0x0000000000449000-memory.dmpFilesize
4KB
-
memory/2012-105-0x000000000042F000-0x0000000000430000-memory.dmpFilesize
4KB
-
memory/2012-68-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/2012-59-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/2012-99-0x0000000000425000-0x0000000000426000-memory.dmpFilesize
4KB
-
memory/2012-109-0x0000000000429000-0x000000000042A000-memory.dmpFilesize
4KB
-
memory/2012-110-0x000000000042D000-0x000000000042E000-memory.dmpFilesize
4KB
-
memory/2012-111-0x0000000000409000-0x000000000040A000-memory.dmpFilesize
4KB
-
memory/2012-112-0x0000000000428000-0x0000000000429000-memory.dmpFilesize
4KB
-
memory/2012-113-0x000000000042A000-0x000000000042B000-memory.dmpFilesize
4KB
-
memory/2012-114-0x000000000043F000-0x0000000000440000-memory.dmpFilesize
4KB
-
memory/2012-115-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/2012-116-0x000000000043E000-0x000000000043F000-memory.dmpFilesize
4KB
-
memory/2012-117-0x000000000044A000-0x000000000044B000-memory.dmpFilesize
4KB
-
memory/2012-118-0x0000000000451000-0x0000000000452000-memory.dmpFilesize
4KB
-
memory/2012-119-0x000000000041A000-0x000000000041B000-memory.dmpFilesize
4KB
-
memory/2012-120-0x000000000044D000-0x000000000044E000-memory.dmpFilesize
4KB
-
memory/2012-122-0x0000000000452000-0x0000000000453000-memory.dmpFilesize
4KB
-
memory/2012-123-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/2012-121-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/2012-124-0x0000000000423000-0x0000000000424000-memory.dmpFilesize
4KB
-
memory/2012-125-0x0000000000453000-0x0000000000454000-memory.dmpFilesize
4KB
-
memory/2012-126-0x0000000000454000-0x0000000000455000-memory.dmpFilesize
4KB
-
memory/2012-127-0x000000000043B000-0x000000000043C000-memory.dmpFilesize
4KB
-
memory/2012-128-0x000000000043C000-0x000000000043D000-memory.dmpFilesize
4KB
-
memory/2012-129-0x0000000000436000-0x0000000000437000-memory.dmpFilesize
4KB
-
memory/2012-132-0x000000000046D000-0x000000000046E000-memory.dmpFilesize
4KB
-
memory/2012-134-0x0000000000416000-0x0000000000417000-memory.dmpFilesize
4KB
-
memory/2012-131-0x0000000000432000-0x0000000000433000-memory.dmpFilesize
4KB
-
memory/2012-130-0x0000000000433000-0x0000000000434000-memory.dmpFilesize
4KB
-
memory/2012-754-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/2028-54-0x0000000076831000-0x0000000076833000-memory.dmpFilesize
8KB
-
memory/2028-57-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/2028-58-0x0000000002500000-0x0000000002954000-memory.dmpFilesize
4.3MB
-
memory/2028-753-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB