Analysis
-
max time kernel
148s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 00:08
Behavioral task
behavioral1
Sample
511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe
-
Size
171KB
-
MD5
a15baae14a7886c47ae9f581d0aed221
-
SHA1
e7544cd38a07ffb8878c20b75b1a631bc8b25be1
-
SHA256
511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a
-
SHA512
6da1fb1f0074b29b9bbb6e331605e1abb7e7fb23479808680a37d0ba4c0f2789f2eaaf5a593491b6faf0498df30a395275a408cd519f305c04f3b5e08998cc8c
-
SSDEEP
3072:IFODvWtpHSlNAyx1+fhvFoEdqhJEkiLgRP19ip8AtIXPcqKG1j+i:cODery71WNPsE9LotABIXUS1P
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3708 _511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe -
resource yara_rule behavioral2/memory/3132-132-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3132-136-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ACLControl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe -
Modifies WinLogon 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Impersonate = "0" 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Asynchronous = "1" 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Logon = "ACLLogon" 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\MicrosoftEdgeComRegisterShellARM64.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\MicrosoftEdgeUpdateBroker.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\dev.identity_helper.exe.manifest 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\wmplayer.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TabTip32.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.165.21\MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.exe.sig 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxcalendarappimm.exe_Rules.xml 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxoutlook.exe_Rules.xml 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TabTip32.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\iexplore.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\chrome_installer.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\MicrosoftEdgeUpdateSetup.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Windows Media Player\en-US\wmlaunch.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\BitLockerDiscoveryVolumeContents\fr-FR_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\lt-LT_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\en-GB\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\it-IT\bfsvc.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\ar-SA_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\el-GR_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\pl-PL_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\sr-Latn-RS_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\ko-KR\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\lt-LT\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\servicing\de-DE\TrustedInstaller.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\el-GR\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\en-US\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\en-US\hh.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\servicing\es-ES\TrustedInstaller.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\da-DK_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\fr-FR\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\zh-TW\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\es-ES\helppane.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\fr-FR\regedit.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\ImmersiveControlPanel\en-US\SystemSettings.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe.manifest 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\zh-CN_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\ja-JP\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\ko-KR\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\qps-ploc\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\en-US\bfsvc.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\de-DE_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\es-ES\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\nb-NO\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\sl-SI\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\de-DE\winhlp32.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\ko-KR_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\cs-CZ\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\it-IT\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\en-US\winhlp32.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\ImmersiveControlPanel\it-IT\SystemSettings.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\ja-JP\winhlp32.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\fr-FR\hh.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\ja-JP\explorer.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\nb-NO_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\tr-TR_BitLockerToGo.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\da-DK\memtest.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\Boot\PCAT\nl-NL\bootmgr.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\de-DE\explorer.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe File created C:\Windows\it-IT\regedit.exe.mui 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3132 wrote to memory of 3708 3132 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe 81 PID 3132 wrote to memory of 3708 3132 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe 81 PID 3132 wrote to memory of 3708 3132 511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe"C:\Users\Admin\AppData\Local\Temp\511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe"1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\_511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exeC:\Users\Admin\AppData\Local\Temp\_511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe "C:\Users\Admin\AppData\Local\Temp\511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe"2⤵
- Executes dropped EXE
PID:3708
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe
Filesize152KB
MD508785071b116574b079df3b4e4d37d4b
SHA10fa56d2e7bf4a2fb62b76b4b073ad8280b6f07aa
SHA256e44497e679a9febec852dbd158fd93ca944c3a4eca34ecfe0aceb4e39a9acc95
SHA5124ac9ed6b4dc49e3174fd33ec131cb24868a2939189d1db46f1480421fa5e0c0f69a49197815fd81ae3ad0968bdcf3ea32968d451bf9f4becfa3fadfd4c458485
-
C:\Users\Admin\AppData\Local\Temp\_511dfbde20fc21dacb173bd7e54cac48014cfb1e7a43a1a97fda52b6d9d75b3a.exe
Filesize152KB
MD508785071b116574b079df3b4e4d37d4b
SHA10fa56d2e7bf4a2fb62b76b4b073ad8280b6f07aa
SHA256e44497e679a9febec852dbd158fd93ca944c3a4eca34ecfe0aceb4e39a9acc95
SHA5124ac9ed6b4dc49e3174fd33ec131cb24868a2939189d1db46f1480421fa5e0c0f69a49197815fd81ae3ad0968bdcf3ea32968d451bf9f4becfa3fadfd4c458485