Analysis
-
max time kernel
121s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:58
Static task
static1
Behavioral task
behavioral1
Sample
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
-
Size
1.1MB
-
MD5
54d188a38d0d38eee7216922a3e840c1
-
SHA1
bf40d686bf119888cae7fab2041a33ed62a85869
-
SHA256
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d
-
SHA512
7c1b7b65968a6ed1c5390f339ccb94f0e23212aea883574737ce4785705ed02ddd867267601305e37d0ce7c3d5a4a68291dba8e847739d40c59f6373f5b1d203
-
SSDEEP
24576:/X/eO4qw611ZlZ38YrKkEROaL3v9Xjrh1TqJk9:+O4ps1ZrbhEYUFXjFtm2
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exedescription ioc process File opened for modification C:\Windows\SysWOW64\instnm.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\setup16.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\netsh.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\secinit.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\sethc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\recover.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\printui.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\taskeng.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\dccw.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\regini.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\sc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\write.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\migwiz\MigSetup.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\setx.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\calc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\cacls.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\winver.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\systray.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\makecab.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe -
Drops file in Windows directory 64 IoCs
Processes:
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exedescription ioc process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_6.1.7601.17514_none_412fcd2afecdc412\mqbkup.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7601.17514_none_b532bb17fea7ee9a\LinqWebConfig.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ocsetup_31bf3856ad364e35_6.1.7601.17514_none_e5849be1bd89e07e\ocsetup.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_1c0dbd69636d746a\ieUnatt.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\sdchange.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_6c6ad9e2fd62ff6a\InfDefaultInstall.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.1.7600.16385_none_44d62330646f757a\DeviceEject.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\wiaacmgr.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\appcmd.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_48b6a2a03e2c7b21\DisplaySwitch.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcxtask_31bf3856ad364e35_6.1.7600.16385_none_b6bc1aae9d0693c5\McxTask.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\eudcsettings.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_aa93298fbb4246f2\osk.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7601.17514_none_7920b60d569a4a1e\wmlaunch.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_0b2696ec2f3c656d\wusa.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\ehome\ehrecvr.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\aspnet_regbrowsers.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_bb77c3d6f6c8e3f6\write.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_f9b9855184ad1e6d\wlanext.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\ehome\ehtray.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-telnet-server-tlntsess_31bf3856ad364e35_6.1.7600.16385_none_05ebf19ca2304436\tlntsess.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_7a1e2959bc43abd5\DpiScaling.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.1.7600.16385_none_243595ae2cf3193f\TsWpfWrp.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_c33f455aebcd9dbb\bthudtask.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_763763505e93084b\IMSCPROP.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\PostMig.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\twunk_16.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_d0632cbfee5db937\sc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\query.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_fd9ec705e687f8c2\WMIC.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_6.1.7601.17514_none_326571587836a400\wsqmcons.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_narrator-nonmsil_31bf3856ad364e35_6.1.7601.17514_none_8b63c5e0db87fde8\Narrator.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\convert.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\ehome\MediaCenterWebLauncher.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\umount.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmstp.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_6b683cb78f534561\mmc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmUi.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_934d08d31b96d4ee\sdchange.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_cd93efad202e5fb6\bthudtask.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_ca00459dda59f6f4\netiougc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_3df12febe293ce5d\tcmsetup.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_533d797efdf7728b\SystemPropertiesAdvanced.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\comp.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_d7dba7b30c3e2855\rundll32.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_mcupdate_31bf3856ad364e35_6.1.7601.17514_none_26c2d72ec26de8d9\mcupdate.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_netfx-jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_14e6e9dab736481d\jsc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-sethc_31bf3856ad364e35_6.1.7601.17514_none_64c7a8e4d35d675c\sethc.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277\lsass.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-proquota_31bf3856ad364e35_6.1.7601.17514_none_85ecfd46a904b22a\proquota.exe 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exepid process 1372 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe"C:\Users\Admin\AppData\Local\Temp\4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1372