Analysis
-
max time kernel
110s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 16:03
Static task
static1
Behavioral task
behavioral1
Sample
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe
-
Size
158KB
-
MD5
5de0647707a3affece2d18ea29fcd890
-
SHA1
e13be4fb215c345f5b7845acaed0f4a13c453c5f
-
SHA256
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5
-
SHA512
0d3e60398d4017215eb57524f868a72dde353fce5d664adce525e7be776f4e4e4836bfea4f04b95446d657beaaf36aed0615d2d5c27066e96c2d3a04986b61d6
-
SSDEEP
3072:j1Ct6U7tTSlHTTujesV9xh7xeQhzi8A4yKrgJc1SoVe:4xtTMToxh7FPLC
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened (read-only) \??\Y: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\A: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\I: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\K: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\R: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\S: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\U: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\X: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\D: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\E: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\F: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\G: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\M: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\P: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\B: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\H: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\J: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\Q: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\W: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\L: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\N: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\O: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\T: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\V: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened (read-only) \??\Z: 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Drops file in System32 directory 64 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\resmon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\reg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\net1.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\tar.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\regini.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\control.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\find.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\clip.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\compact.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\fc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\expand.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\setup16.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\makecab.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\winver.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\cacls.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\calc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\finger.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\runonce.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\sc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\at.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SysWOW64\print.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\7-Zip\7z.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\chrome_installer.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Drops file in Windows directory 64 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\uwfux.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.19041.1_none_857c0c60dec56103\snmptrap.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\rdpsign.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.1_none_03831cf8d49cee55\prevhost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_6698d138e79617d9\dcomcnfg.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\r\msconfig.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpshell.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\autofmt.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.844_none_3ca0ef366c7d7a84\n\Dism.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\r\dmclient.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\f\FileExplorer.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_1b0846060f09c968\gpscript.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1573dfb37c7563ca\write.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5ffcb7ce21b4d707\aspnet_state.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\wecutil.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\cscript.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\f\netiougc.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.1_none_484e61e96e69ac70\CameraBarcodeScannerPreview.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.19041.1_none_14b1d8fa41ae50fb\MicrosoftEdgeBCHost.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\DWWIN.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\f\DWWIN.EXE 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\r\WinSAT.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\GamePanel.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\WerFaultSecure.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c4e6302d398f7e04\mscorsvw.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\r\mmgaserver.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.19041.1_none_1c5807cd8d0c767e\OptionalFeatures.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\r\BdeUISrv.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpinit.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\FsIso.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1_none_0d7764d82a75e629\BitLockerWizardElev.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_ed965939376efbbf\MigRegDB.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a790160b3d9e046c\ilasm.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\n\AssignedAccessGuard.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.19041.1_none_2da6c69fad3fdf0b\DsmUserTask.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_d9afbb23e990d44a\aspnet_compiler.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\mmgaserver.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\PerceptionSimulationInput.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\convertvhd.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1_none_b0493212512a7f1a\ntprint.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1237_none_665f7346099d6350\bdechangepin.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15805.0_none_7219923700ae18c0\RegAsm.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\wextract.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\WindowsActionDialog.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_7d38f956251354fe\mscorsvw.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\f\DiskSnapshot.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\bash.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_c26c8624c595ae48\GameBarPresenceWriter.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_680d56683fad152b\f\isoburn.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_ed4924afa14354c2\sdchange.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\InputSwitchToastHandler.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\f\Taskmgr.exe 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Modifies registry class 39 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\1 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mid\ = "MIDFile" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell\open 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\0\ = "&Play" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler32 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\PackageObjects 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol\StdFileEditing 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdExecute 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler\ = "mciole16.dll" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\ = "Media Clip" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol\StdFileEditing\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol\StdFileEditing\server\ = "mplay32.exe /avi" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell\open\command 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\insertable\ 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\0 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\verb\1\ = "&Edit" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdExecute\server\ = "mplay32.exe" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler32\ = "mciole32.dll" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol\StdFileEditing\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\insertable 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\protocol 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\shell\open\command\ = "mplay32.exe /play /close %1" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\handler 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\PackageObjects\ 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdFileEditing\server\ = "mplay32.exe" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.avi\ = "AVIFile" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol\StdExecute\server 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\protocol 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol\StdFileEditing 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rmi\ = "MIDFile" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIDFile\protocol\StdFileEditing\server\ = "mplay32.exe /mid" 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 5044 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5044 AUDIODG.EXE -
Suspicious use of SetWindowsHookAW 1 IoCs
Processes:
23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exepid process 4920 23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe"C:\Users\Admin\AppData\Local\Temp\23068ebd17f473d339ea9c1f7ae9789e31b0f981cd62a175528d5499a868dce5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookAW
PID:4920
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x310 0x2f81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044