Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09/03/2023, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
Resource
win10v2004-20230220-en
General
-
Target
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
-
Size
383KB
-
MD5
169252f7614bf6c6b43e8532e6623d57
-
SHA1
30e2c45ff71eb78c7d1a1032b3b2c46c9d87e24e
-
SHA256
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8
-
SHA512
d116c247d1e3b7f7025dc01e100043a62b635dbe04f4ae0b3f94ba17936ba859b7edb321ac54fa26a1016ee97555a43fc536290b334b84fd0c2b124c5958b1ab
-
SSDEEP
6144:8RzMgpY8bXFHW1FbwwEHidUoagoW2C9cuqBGI4Zq6mYlGVYJNfNQFoQGt485VYg+:qDRbXFHW1+K2UWBGIymYeYJheFOvd+
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Deletes itself 1 IoCs
pid Process 1532 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe" 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk7100t.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpd7500t.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hphp910t.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp8500at.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smx8x3u.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumE\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comment_Based_Help.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scopes.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_job_details.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_WMI_Cmdlets.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Redirection.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO5600T.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7400t.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\erofflps.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremiumN\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Comment_Based_Help.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Foreach.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\StarterE\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_do.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Language_Keywords.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\Starter\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\EnterpriseE\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\Enterprise\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Starter\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\System.Management.Automation.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicE\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterE\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateN\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_operators.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssession_details.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_transactions.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Starter\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO4300T.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPOGDS3L.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_logical_operators.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\System.Management.Automation.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_properties.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_debuggers.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_regular_expressions.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\Ultimate\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Enterprise\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicN\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_type_operators.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\Microsoft.PowerShell.Security.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_format.ps1xml.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_aliases.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\about_BITS_Cmdlets.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremium\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_jobs.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Throw.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Continue.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\Amd64\tsmpu002.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\about_BITS_Cmdlets.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\License.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_en-us_8a074a396aa9e5f1\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_712dbc2cbc5c6e97\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\System.Management.Automation.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_script_blocks.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7601.17514_none_6fb51b358e21d75f\boxed-join.avi 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPF6940T.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp4.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_efb864eb1b8d487f\Report.System.Wired.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Special_Characters.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-iis-powershellprovider_31bf3856ad364e35_6.1.7600.16385_none_0199f7b39523c414\NavigationTypes.namespace.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\Microsoft.Wsman.Management.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_es-es_732cba6fafcc6991\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_en-us_83a96f16be1ecf82\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_de-de_119b79ee0275a321\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_job_details.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_pssession_details.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Switch.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp2.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Performance.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_escape_characters.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\keypadbase.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_data_sections.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_prnca00a.inf_31bf3856ad364e35_6.1.7600.16385_none_dcb5d501c451bacd\Amd64\CNBJ3190.TBL 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPC1RWSL.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Break.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_types.ps1xml.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft.windows.d..ackmodule.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_636bce033bdf4cd0\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_1f3ca993b38eba0f\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Foreach.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_92c644cf14bd6a75\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_117bd8ffb46dd92c\Report.System.CPU.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b4334efea73fef8e\Report.System.CPU.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wlansvc_31bf3856ad364e35_6.1.7601.17514_none_fa6a47c21b85ab79\Rules.System.Wireless.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_script_internationalization.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_en-us_f04371ec21c4626e\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-dmrxml_31bf3856ad364e35_6.1.7600.16385_none_9d23d74d960a8256\MediaCenter.DigitalMediaRenderer.RenderingControl.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_it-it_8a2102afb657186e\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_de-de_45728647f85d9477\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_execution_policies.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Line_Editing.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_transactions.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cd9932e5aaee1f78\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp5.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.NetDiagFramework.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Quoting_Rules.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7c3aeb36c5f98c70\gadget.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_en-us_79dfc17d433a5b9b\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_es-es_19ca50f581629767\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Summary.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_101d52bed2c0d719\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_de-de_f1c4ddbe1d6460ac\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Automatic_Variables.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_functions_advanced_methods.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_en-us_9cd795cebc886acf\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\GlobalInstallOrder.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1044\LocalizedData.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_en-us_ad01b0cc7d80f411\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_escape_characters.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\Microsoft.PowerShell.Commands.Management.dll-Help.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Automatic_Variables.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Throw.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_4c2d6a53da48c549\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_prompts.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_profiles.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\Desktop 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\Desktop\ 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\Desktop\TileWallpaper = "0" 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2044 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe 2044 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1532 2044 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe 31 PID 2044 wrote to memory of 1532 2044 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe 31 PID 2044 wrote to memory of 1532 2044 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe 31 PID 2044 wrote to memory of 1532 2044 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe 31 PID 1532 wrote to memory of 824 1532 cmd.exe 33 PID 1532 wrote to memory of 824 1532 cmd.exe 33 PID 1532 wrote to memory of 824 1532 cmd.exe 33 PID 1532 wrote to memory of 824 1532 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe"C:\Users\Admin\AppData\Local\Temp\933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ACCDE.bat" "2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:824
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
309B
MD5610d078fd067a8c27a42b93a7c20a6ca
SHA19a2bc33ae76389d2c6bd6c1844b1cc2b802b368c
SHA256e661b7d38413fe96d0923646cea1089af6a5cec3bcf854e1204d20a08728a2e7
SHA51214c13fb72c965bb649b84297b9d4fb7c963838b3f11021bd20038c12384d307c73fd196296cddfe9e8c4a73e55cf743fa06393d36b71757e5539c36ec0473ce0
-
Filesize
309B
MD5610d078fd067a8c27a42b93a7c20a6ca
SHA19a2bc33ae76389d2c6bd6c1844b1cc2b802b368c
SHA256e661b7d38413fe96d0923646cea1089af6a5cec3bcf854e1204d20a08728a2e7
SHA51214c13fb72c965bb649b84297b9d4fb7c963838b3f11021bd20038c12384d307c73fd196296cddfe9e8c4a73e55cf743fa06393d36b71757e5539c36ec0473ce0