Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe
-
Size
60KB
-
MD5
a2c6d109b1f5015e1c7ca1f6b3484710
-
SHA1
5457ca19b1d6b0d59f77180896c6036ac23e258a
-
SHA256
ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500
-
SHA512
66119e9c277294de43180ba0382063427f8404e68e9e07f7f627612d24761c22507ce6e2994917f5e3f8f9f38ce7190bf70e385e2a3f796a2680801d7de4eac3
-
SSDEEP
768:jfsQ57Q/dgsE73tULYYsEVlL9GDxt/d0cxSgtlOrvHTR+oPFxH:oY+gsQ3tUVsEVlx82cVGr4oPP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\T: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\U: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\X: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\F: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\J: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\K: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\Q: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\V: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\Z: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\A: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\G: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\N: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\P: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\R: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\S: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\W: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\Y: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\B: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\E: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\H: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\L: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\M: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened (read-only) \??\O: ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\lodctr.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\regini.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\finger.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\calc.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\DisplaySwitch.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\relog.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\user.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\osk.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\takeown.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\control.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\getmac.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\autochk.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\efsui.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\mshta.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\sort.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\migwiz\mighost.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\msdt.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\sfc.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\logagent.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\where.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\instnm.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\verifier.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\LocationNotifications.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\at.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\icacls.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_b07e19d8a98c26cf\dcomcnfg.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_6f74b7d163601da2\DevicePairingWizard.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_6.1.7600.16385_none_493ba8a4d2fc9697\StikyNot.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_1838ef0586d5af46\syskey.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin_31bf3856ad364e35_6.1.7600.16385_none_12c5b5b81f2d2f1d\evntwin.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_1ddd261c4e350476\upnpcont.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\msil_addinprocess_b77a5c561934e089_6.1.7601.17514_none_f9a5b9a7f0e068e4\AddInProcess.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_2d26f786c50448ba\MigRegDB.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-makecab_31bf3856ad364e35_6.1.7600.16385_none_f0a5d809ca926e4f\makecab.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_fed8c13f0d90a8cf_winmgmt.exe_8f8eb7b1 ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\TRACERT.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\twunk_32.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_cb3bc16fc2624947\rasdial.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_6.1.7600.16385_none_14f9b9481db6293b\evntcmd.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tzutil_31bf3856ad364e35_6.1.7601.17514_none_9269da4819c69a89\tzutil.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchIndexer.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17514_none_3471a890d8284f57\spoolsv.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\shadow.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\poqexec.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_d63cc4dd74a11d0b\DpiScaling.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\psxrun.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_df7c5af777ec4541_drvinst.exe_6593e92a ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..iuminboxgames-chess_31bf3856ad364e35_6.1.7600.16385_none_d0c99374981840d5\Chess.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_e932cc2c30fc13b0\cmd.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_c8897566b5c070a0\InfDefaultInstall.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-proquota_31bf3856ad364e35_6.1.7601.17514_none_85ecfd46a904b22a\proquota.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPMGR.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhost.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_5aad0353642dd29f\SystemPropertiesPerformance.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_mcupdate_31bf3856ad364e35_6.1.7601.17514_none_26c2d72ec26de8d9\mcupdate.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ehrecvr.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63\auditpol.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-addinutil_31bf3856ad364e35_6.1.7601.17514_none_29443e96f9fb6564\AddInUtil.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7600.16385_none_7c6ba3bd1f954290_wermgr.exe_d92a3b6c ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_3.5.7600.16385_none_8c3cf176a8e91487\MSBuild.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasdial.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-secinit_31bf3856ad364e35_6.1.7600.16385_none_878e469b2e51ce80\secinit.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\ROUTE.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\ehome\Mcx2Prov.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPUEX.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_752e3bb068638683\msfeedssync.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_498d334c14a3b9bb\hwrreg.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_lodctr.exe_b02cefba ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce\bridgeunattend.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmplayer.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_7444913c36004801\sc.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\aspnet_regbrowsers.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-alg_31bf3856ad364e35_6.1.7600.16385_none_04de43c774cf8fe3\alg.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647_appidpolicyconverter.exe_83972af0 ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\perfhost.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\HOSTNAME.EXE ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-vssadmin_31bf3856ad364e35_6.1.7600.16385_none_c453ab9392f73dca\vssadmin.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe"C:\Users\Admin\AppData\Local\Temp\ab3a365f4a5b7729c3dc9bf5368ae0ace4586ad2561596878a847b31c3afa500.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:584