Analysis
-
max time kernel
144s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 16:03
Static task
static1
Behavioral task
behavioral1
Sample
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe
-
Size
158KB
-
MD5
5de0647707a3affece2d18ea29fcd890
-
SHA1
e13be4fb215c345f5b7845acaed0f4a13c453c5f
-
SHA256
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5
-
SHA512
0d3e60398d4017215eb57524f868a72dde353fce5d664adce525e7be776f4e4e4836bfea4f04b95446d657beaaf36aed0615d2d5c27066e96c2d3a04986b61d6
-
SSDEEP
3072:j1Ct6U7tTSlHTTujesV9xh7xeQhzi8A4yKrgJc1SoVe:4xtTMToxh7FPLC
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened (read-only) \??\O: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\R: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\B: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\J: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\M: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\P: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\S: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\U: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\Y: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\H: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\L: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\E: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\G: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\K: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\W: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\Z: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\A: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\D: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\N: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\Q: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\T: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\V: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\X: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\F: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\I: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Drops file in System32 directory 64 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\winrs.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\DisplaySwitch.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\sc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\PING.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\resmon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\control.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\find.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\SetIEInstalledDate.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\help.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\newdev.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\ntkrnlpa.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\migwiz\mighost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wscript.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\netsh.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\calc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\icardagt.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\diantz.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\reg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Drops file in Windows directory 64 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_74578a893f33207c\syskey.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_144b6bd462e4a41b\vbc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17514_none_d281ccc018b94ff4\conhost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_13305696250bcb70\WPDShextAutoplay.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\Solitaire.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_bb77c3d6f6c8e3f6\write.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58\CertEnrollCtrl.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\mtstocom.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\ehome\Mcx2Prov.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7601.17514_none_7d0125c85cc31d2a\rdpshell.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_901eda10f3ab38d2\McrMgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_5da314d233bb2676\dvdplay.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce\bridgeunattend.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_3fbc74d90a6e33f8\NetProj.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17514_none_3471a890d8284f57\spoolsv.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_unlodctr.exe_69df45bb 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\0b4d4e172e8054cb61d27f5ab9e0e445\SMSvcHost.ni.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_800bbdee85723191\RmClient.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\logoff.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_247621f7aa7542ff\ImagingDevices.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf\hdwwiz.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_5fbe9f67bec0f818\runas.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\ehome\ehmsas.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_ea12784c0842bfc1\mspaint.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_a0c922c3b170dd5d\RegisterIEPKEYs.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_bfa748753634ba48\SystemPropertiesProtection.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89_winresume.exe_85cd1215 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb_hh.exe_f87e0044 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7_dnscacheugc.exe_aa32623e 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPDSVR.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_6f74b7d163601da2\DevicePairingWizard.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_c9392808773cd7da\cleanmgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_d527b0a5438b8346\drvinst.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iisrstas.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\tsdiscon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636_winlogon.exe_ac37d0c5 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d_printui.exe_bb673fff 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8\expand.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1_netbtugc.exe_825f4f74 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIADAP.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_wcf-icardagt_exe_31bf3856ad364e35_6.1.7600.16385_none_8dcc9c6f8b58a5eb\icardagt.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_a7b238407d550501\clip.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-vssadmin_31bf3856ad364e35_6.1.7600.16385_none_c453ab9392f73dca\vssadmin.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_c405852b31194b0b\certreq.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\replace.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Modifies registry class 39 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell\open 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\1 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol\StdFileEditing 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol\StdFileEditing\server\ = "mplay32.exe /avi" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell\open\command\ = "mplay32.exe /play /close %1" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\PackageObjects 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\0\ = "&Play" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.avi\ = "AVIFile" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol\StdFileEditing\server\ = "mplay32.exe /mid" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell\open\command 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdExecute\server\ = "mplay32.exe" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\insertable\ 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mid\ = "MIDFile" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol\StdFileEditing\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler32 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\server\ = "mplay32.exe" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdExecute\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\0 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rmi\ = "MIDFile" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol\StdFileEditing 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\ = "Media Clip" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol\StdFileEditing\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\PackageObjects\ 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler\ = "mciole16.dll" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\insertable 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler32\ = "mciole32.dll" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\1\ = "&Edit" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdExecute 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1660 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1660 AUDIODG.EXE Token: 33 1660 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1660 AUDIODG.EXE -
Suspicious use of SetWindowsHookAW 1 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exepid process 1992 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe"C:\Users\Admin\AppData\Local\Temp\23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookAW
PID:1992
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4101⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660