Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe
-
Size
108KB
-
MD5
a13993d055dc0f9c3de41e115beceb40
-
SHA1
9787343996c078f4617308baa35c1d871c6b4427
-
SHA256
ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381
-
SHA512
1279ad99f558d3434fabf23b13143363d233859107b1e06b3f3cbc54ca9580413c4f7ab1473000915cbcd04d6465a49de6715b98f9026a3b34b8072fdc113851
-
SSDEEP
1536:EE+pYZuwo8FBM3sOBb6hXvZ46ycV8xm7SL1ToisSzJEyIwXf5CD3o4c:EE+pYZuwoPRBu34bmg/sSzOyzxC7o4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened (read-only) \??\B: ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cmdkey.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\cscript.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\setup16.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\migwiz\mighost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\svchost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\drvinst.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\where.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\at.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\ntoskrnl.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\subst.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\comp.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\dialer.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\diskraid.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\notepad.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\newdev.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\resmon.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\systray.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\calc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\DisplaySwitch.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\netsh.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\winver.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\certutil.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\clip.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\cmd.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\proquota.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\relog.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\verifier.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\expand.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\charmap.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\efsui.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\icardagt.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\SysWOW64\runonce.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\7-Zip\7z.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_6.1.7600.16385_none_78e75d04c1b0c873\fvenotify.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3_csrss.exe_06529458 ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_2b95a17838063e9b\AtBroker.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehsched_31bf3856ad364e35_6.1.7600.16385_none_0167f08155bf1c81\ehsched.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpupdate.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339 ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.17514_none_a1636a92177e3020\prevhost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXTutorial.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\IMCCPHR.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_0e4e6b146b2452a9\mountvol.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_1ddd261c4e350476\upnpcont.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_regsvcs_b03f5f7f11d50a3a_6.1.7601.17514_none_76de745b101f0148\RegSvcs.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_3df12febe293ce5d\tcmsetup.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_74578a893f33207c\syskey.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_f4285a06060032a9\vbc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\TRACERT.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..tomizationsnonwinpe_31bf3856ad364e35_6.1.7601.17514_none_29f4eed2a5d64c25\PnPUnattend.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7601.17514_none_5e47617f33c574ac\SMConfigInstaller.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_17dbc2dd2d2552c7\verclsid.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vdsldr.exe_20c491b3 ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\icsunattend.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcx2prov_31bf3856ad364e35_6.1.7600.16385_none_3482237b32c1daff\Mcx2Prov.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CISVC.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_6.1.7601.17514_none_412fcd2afecdc412\mqbkup.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\ehome\WTVConverter.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_498d334c14a3b9bb\hwrreg.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qprocess.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnpui_31bf3856ad364e35_6.1.7600.16385_none_bacc830144fa7791\dinotify.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce_lsm.exe_ecbd567a ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\eudcsettings.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\SvcIni.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\setupsqm.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_f560eae4c42edb14\control.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmEngine.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58_certenrollctrl.exe_9495aa75 ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_3020274b22e8a90f\help.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_11b913172f0cb26f\ieUnatt.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_6.1.7600.16385_none_e47ee9c51ad9df17\ktmutil.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce\bridgeunattend.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-addinutil_31bf3856ad364e35_6.1.7601.17514_none_29443e96f9fb6564\AddInUtil.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496_wowreg32.exe_94fc2d06 ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_32a601ad2b7a554f\PDMSetup.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\logman.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe"C:\Users\Admin\AppData\Local\Temp\ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2000