Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:03
Behavioral task
behavioral1
Sample
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe
Resource
win7-20221111-en
General
-
Target
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe
-
Size
136KB
-
MD5
c6bfb172211360367053fbd5f65655de
-
SHA1
693449073331dacef7bc0ae97afd5da26a1f602e
-
SHA256
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec
-
SHA512
a227c8952078c5a9faeed0e4fb9c7c832397585650d57591d8ce756457f39d417fda368205e04fbe2197ad8f40106d3a5b4c2b02f80790d0610819046ae22409
-
SSDEEP
1536:JxqjQ+P04wsmJCdHfqS+lPwXvOdaBYD4OKUcNz8GQGZT524ut/skr+dExmX8Wwb:sr85CdT+l4/KaBYDr9GX9w4whkExs8WW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule C:\ODT\office2016setup.exe family_neshta -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Executes dropped EXE 1 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exepid process 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Processes:
resource yara_rule behavioral2/memory/4460-135-0x0000000002920000-0x00000000039AE000-memory.dmp upx behavioral2/memory/4460-139-0x0000000002920000-0x00000000039AE000-memory.dmp upx behavioral2/memory/4460-140-0x0000000002920000-0x00000000039AE000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process File opened (read-only) \??\J: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\Q: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\R: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\S: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\W: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\E: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\G: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\H: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\F: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\L: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\U: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\O: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\X: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\Y: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\K: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\M: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\N: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\V: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\Z: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\I: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\P: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened (read-only) \??\T: f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process File opened for modification C:\autorun.inf f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Drops file in System32 directory 10 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process File created \??\c:\Windows\SysWOW64\IME\IMETC\LIMTCLNWZ.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SysWOW64\IME\IMETC\YLIMTCLNWZ.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Ipowershell.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SysWOW64\IME\IMETC\YLIMTCLNWZ.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Ipowershell.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Fpowershell_ise.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Fpowershell_ise.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SysWOW64\IME\IMETC\LIMTCLNWZ.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SysWOW64\IME\IMETC\WIMTCPROP.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SysWOW64\IME\IMETC\WIMTCPROP.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exef7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Drops file in Windows directory 64 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exef7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process File created \??\c:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\SOOBENetworkConnectionFlow.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\f\LClipUp.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\AByteCodeGenerator.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\f\Happidtel.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\MAppVStreamingUX.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.19041.1_none_0e40322ba49953c6\Kcacls.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\f\Kautofmt.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\Windows\SYSTEM.INI f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\SNarratorQuickStart.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\MXGpuEjectDialog.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_aae8e58aa310aa7d\Teventvwr.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\Ywindeploy.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\r\EbackgroundTaskHost.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\CPinningConfirmationDialog.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\r\Pvmwp.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\f\Tvmwp.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\NSyncAppvPublishingServer.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_83b794e5516730a0\SAddSuggestedFoldersToLibraryDialog.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\Palg.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification C:\Windows\svchost.com f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\CFilePicker.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\XPeopleExperienceHost.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\QVmComputeAgent.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\QEoAExperiences.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\Xtcblaunch.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\r\Wwbengine.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\Nbootcfg.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_3d521dedd6c76700\Rhcsdiag.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\r\Bhnsdiag.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\Hvmwp.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\f\Gdirectxdatabaseupdater.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\Vpcalua.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\Ibrowserexport.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\XAppVShNotify.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1_none_604b329da953cf68\JFaceFodUninstaller.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\f\BbackgroundTaskHost.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\CFilePicker.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\Whcsdiag.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\Ewindeploy.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\MScriptRunner.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\CSyncAppvPublishingServer.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\r\Naitstatic.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\f\GAppResolverUX.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\XAppResolverUX.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\GSecureAssessmentBrowser.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File opened for modification \??\c:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\ITextInputHost.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\Xhvax64.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\f\Rvmms.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\f\Lpcaui.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\Xwinresume.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\Mvmcompute.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\r\IIcsEntitlementHost.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\Wuwfmgr.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\Iwinresume.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\Moobeldr.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\EAppVDllSurrogate.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\r\LSndVol.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.19041.1_none_1b8420121296312d\KLogonUI.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\Bhvix64.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\Eoobeldr.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\r\RAddSuggestedFoldersToLibraryDialog.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\f\Qwinload.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1_none_dc058eb644f1f90b\Lbfsvc.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe File created \??\c:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\GShellExperienceHost.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exepid process 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription pid process Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Token: SeDebugPrivilege 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exepid process 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exef7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription pid process target process PID 4148 wrote to memory of 4460 4148 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe PID 4148 wrote to memory of 4460 4148 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe PID 4148 wrote to memory of 4460 4148 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe PID 4460 wrote to memory of 784 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 780 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 992 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe dwm.exe PID 4460 wrote to memory of 2340 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe sihost.exe PID 4460 wrote to memory of 2352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 2448 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe taskhostw.exe PID 4460 wrote to memory of 3036 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Explorer.EXE PID 4460 wrote to memory of 3136 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 3352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe DllHost.exe PID 4460 wrote to memory of 3452 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe StartMenuExperienceHost.exe PID 4460 wrote to memory of 3524 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 3608 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe SearchApp.exe PID 4460 wrote to memory of 3888 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 4664 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 4148 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe PID 4460 wrote to memory of 4148 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe PID 4460 wrote to memory of 784 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 780 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 992 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe dwm.exe PID 4460 wrote to memory of 2340 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe sihost.exe PID 4460 wrote to memory of 2352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 2448 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe taskhostw.exe PID 4460 wrote to memory of 3036 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Explorer.EXE PID 4460 wrote to memory of 3136 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 3352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe DllHost.exe PID 4460 wrote to memory of 3452 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe StartMenuExperienceHost.exe PID 4460 wrote to memory of 3524 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 3608 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe SearchApp.exe PID 4460 wrote to memory of 3888 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 4664 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 784 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 780 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 992 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe dwm.exe PID 4460 wrote to memory of 2340 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe sihost.exe PID 4460 wrote to memory of 2352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 2448 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe taskhostw.exe PID 4460 wrote to memory of 3036 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Explorer.EXE PID 4460 wrote to memory of 3136 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 3352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe DllHost.exe PID 4460 wrote to memory of 3452 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe StartMenuExperienceHost.exe PID 4460 wrote to memory of 3524 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 3608 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe SearchApp.exe PID 4460 wrote to memory of 3888 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 4664 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 784 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 780 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 992 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe dwm.exe PID 4460 wrote to memory of 2340 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe sihost.exe PID 4460 wrote to memory of 2352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 2448 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe taskhostw.exe PID 4460 wrote to memory of 3036 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe Explorer.EXE PID 4460 wrote to memory of 3136 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe svchost.exe PID 4460 wrote to memory of 3352 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe DllHost.exe PID 4460 wrote to memory of 3452 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe StartMenuExperienceHost.exe PID 4460 wrote to memory of 3524 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 3608 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe SearchApp.exe PID 4460 wrote to memory of 3888 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 4664 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe RuntimeBroker.exe PID 4460 wrote to memory of 784 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 780 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe fontdrvhost.exe PID 4460 wrote to memory of 992 4460 f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe dwm.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:992
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2352
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2448
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe"C:\Users\Admin\AppData\Local\Temp\f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe"2⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3136
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3352
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3452
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3524
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3608
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4664
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ODT\office2016setup.exeFilesize
5.1MB
MD502c3d242fe142b0eabec69211b34bc55
SHA1ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e
SHA2562a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
SHA5120efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099
-
C:\Users\Admin\AppData\Local\Temp\3582-490\f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exeFilesize
96KB
MD55e74e866f285c43755b33ac15e57ffdb
SHA19f229303683d910c361f0094a64f6201246cd7cd
SHA25606cf812b674ac308aed8e56d194f595a6c62f1c21d5cd9b7c738dcf9ffaa9aad
SHA51284af74456a249c44754e3e777a0788114c9f0aae382d99768da70db7ccea4bb47d86b0504412aa6028c63b18f3d4c4865d8d4fc2e526c41c3af723b6259b8deb
-
C:\Users\Admin\AppData\Local\Temp\3582-490\f7c82635ca7d853d5a1cd59d1b539af1b0d4bb4580c5b3bcf2e1f35d03a388ec.exeFilesize
96KB
MD55e74e866f285c43755b33ac15e57ffdb
SHA19f229303683d910c361f0094a64f6201246cd7cd
SHA25606cf812b674ac308aed8e56d194f595a6c62f1c21d5cd9b7c738dcf9ffaa9aad
SHA51284af74456a249c44754e3e777a0788114c9f0aae382d99768da70db7ccea4bb47d86b0504412aa6028c63b18f3d4c4865d8d4fc2e526c41c3af723b6259b8deb
-
memory/4460-132-0x0000000000000000-mapping.dmp
-
memory/4460-135-0x0000000002920000-0x00000000039AE000-memory.dmpFilesize
16.6MB
-
memory/4460-138-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4460-139-0x0000000002920000-0x00000000039AE000-memory.dmpFilesize
16.6MB
-
memory/4460-140-0x0000000002920000-0x00000000039AE000-memory.dmpFilesize
16.6MB