Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe
-
Size
262KB
-
MD5
a33cc8c97669042961e6a13e0a424060
-
SHA1
8d1c3f2acf901de323126407869c6f8ead97596b
-
SHA256
65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41
-
SHA512
6893123c3fedc4c756626bb1f314071859bf5f6d4db9f6de64c23671611c91e0e3f3222f6ff74777b937d16d773eb3e56e3bca07c88673dfb73219b1811ac905
-
SSDEEP
3072:6P7SuAWFyAgHlI6EbLuweIExg7d8dTwNAGDiNFm/6sFccng4/x/qz1ou:gbnTGIfAI7p8dTwNd//q
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened (read-only) \??\B: 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\BHO\ie_to_edge_stub.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.165.21\MicrosoftEdgeUpdateCore.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.165.21\MicrosoftEdgeComRegisterShellARM64.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.165.21\MicrosoftEdgeUpdate.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\write.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\bfsvc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Panther\setup.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe File opened for modification C:\Windows\winhlp32.exe 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open\command 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\shell 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe,1" 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\ = "Fax Cover Page" 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print\command 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\DefaultIcon 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5044 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5044 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe 5044 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4612 5044 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe 82 PID 5044 wrote to memory of 4612 5044 65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe"C:\Users\Admin\AppData\Local\Temp\65ba6b043e119de3ac226b87b194e8311d3ad67018b4fcc21bf94db5c57eeb41.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4612
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3328