Analysis
-
max time kernel
85s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe
-
Size
436KB
-
MD5
2174eebea69195d0713cf32f1f8f2fdc
-
SHA1
56003d633ae22dcb1a4736e88a263efea66763e2
-
SHA256
bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee
-
SHA512
dc4944988950c89473caefb3bb9a461d27fdeabc83af36a53733b1030cc802f84f5e98b413c6391a3deefa64c31216febbcd38871cdc64d178ca86da33b55364
-
SSDEEP
6144:DW0rvX/eSqjc3HsTaxoq3svM45ElHcahWWRRXU6llDVA9oL4:/X/eOyaiq3svMAEFcgWWRRX5ncM4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\systeminfo.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\timeout.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\diantz.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\hh.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\logman.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\cttune.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\Dism.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\mshta.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\reg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\secinit.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\certreq.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\control.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\explorer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\migwiz\migwiz.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\user.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\migwiz\MigSetup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\systray.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\raserver.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\wextract.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\fc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\resmon.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\verifier.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\DisplaySwitch.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\wscript.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\7-Zip\7z.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_402eca316047a0fe\dialer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\mtstocom.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_0c2c92921b2478ef\regini.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\TCPSVCS.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7601.17514_none_c6fe6ac9ac8c7105\diskpart.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigSetup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_6.1.7601.17514_none_864c8948d3a4b9f3\mqtgsvc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\csc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_6.1.7600.16385_none_a0a25363eee12f40\colorcpl.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchIndexer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\ehome\ehrec.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-efs-ui_31bf3856ad364e35_6.1.7600.16385_none_f64b1e25e8ea1172\efsui.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63\auditpol.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\msil_edmgen_b77a5c561934e089_6.1.7601.17514_none_cddf79f7120d371d\EdmGen.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_b627d45ffdcc6f00\winver.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_58ca66f699d77ff1\xwizard.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_6.1.7600.16385_none_cc12387f7062eb3b\cliconfg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_6.1.7600.16385_none_493ba8a4d2fc9697\StikyNot.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7601.17514_none_7d0125c85cc31d2a\rdpshell.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\_isdel.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_7444913c36004801\sc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_a223bd3dd785391a\dw20.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_6.1.7601.17514_none_e6510234bbcb2a8c\bcdedit.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_463f54aa539a0b62\DeviceProperties.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-wizard_31bf3856ad364e35_6.1.7600.16385_none_7680aa7b6195f2c6\DVDMaker.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\wowreg32.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\wiaacmgr.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchFilterHost.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_441eccc2f13eab51\iecleanup.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_cb3bc16fc2624947\rasphone.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_6.1.7600.16385_none_761ad65676427bd9\sdiagnhost.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_046c078df2caf5d8\ngen.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_e99b83c8fd064a06\InetMgr6.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_54f9c5c33edc5fbb\forfiles.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_0d6fabd7def3be93\PushPrinterConnections.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\typeperf.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_02bb0612dc529329\diantz.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_38dc646bf68909f4\cmdkey.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickLearningWizard.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_6.1.7601.17514_none_85ac7bd736dda285\UserAccountControlSettings.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_d76c81de4a71c338\ilasm.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_eventviewersettings_31bf3856ad364e35_6.1.7600.16385_none_50ecc9ae1d642aa9\eventvwr.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\showmount.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7601.17514_none_4f18faed6aae2509\bitsadmin.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\ehome\MediaCenterWebLauncher.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_6.1.7600.16385_none_9d299157e03ce00f\klist.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\msil_addinprocess_b77a5c561934e089_6.1.7601.17514_none_f9a5b9a7f0e068e4\AddInProcess.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.1.7601.17514_none_5faf9128a3432508\snmp.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_cfcaa9124aa42f85\SyncHost.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_c90e996c4aa655c4\Robocopy.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_6.1.7600.16385_none_f8a40495785334a9\PrintIsolationHost.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFaultSecure.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\umount.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_6.1.7600.16385_none_6550a9de9a702b0f\powercfg.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\user.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\user.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2000 bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe"C:\Users\Admin\AppData\Local\Temp\bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2000