Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
359s -
max time network
361s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27/08/2023, 09:04
Behavioral task
behavioral1
Sample
shell-x86.exe
Resource
win7-20230712-en
windows7-x64
9 signatures
150 seconds
General
-
Target
shell-x86.exe
-
Size
72KB
-
MD5
731a851ba42100f006f2c6529bafbd93
-
SHA1
68733cb8fb9692a49fc1335d17b563ede9cddc8c
-
SHA256
7625ea528bb506a8fb7501348eaf4271070830600dca0ef4be3ea4856844c07f
-
SHA512
30282a29901fa33dfd4c8222e7d9ed8bae186af76173bfc3cae50b81442b6fc4b99e46a28b6830b5de21f48262cd903933cecd78cd98112d84a8528c448fc93a
-
SSDEEP
1536:IoFsvW69TtaorCtiwyQNUW+i6Zha5kfit3cMb+KR0Nc8QsJq39:BFsu679QNj+i6y6fitMe0Nc8QsC9
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/reverse_tcp
C2
147.185.221.16:33811
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Drops file in Drivers directory 39 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\scfilter.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\tcpip.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\pacer.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\scfilter.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\bfe.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\bfe.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\pacer.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\pacer.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\tcpip.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\pacer.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\qwavedrv.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\scfilter.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\qwavedrv.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\pacer.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\scfilter.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\gmreadme.txt cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\qwavedrv.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\gm.dls cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\bfe.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\bfe.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\bfe.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\bfe.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\tcpip.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\qwavedrv.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\tcpip.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\qwavedrv.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\pacer.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\scfilter.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\qwavedrv.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\tcpip.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\tcpip.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\scfilter.sys.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\wimmount.sys cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 51 IoCs
description ioc Process File opened for modification \??\c:\Windows\winsxs\AM912A~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMFB84~1.175\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMFF91~1.164\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM6927~1.175\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM28D3~1.163\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMC003~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM131F~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMCCDB~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM50D0~1.175\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMEEEB~1.163\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMFA6B~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM2473~1.163\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM5C97~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMC04C~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM0353~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMB428~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM5CD3~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMCF3A~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMB6BD~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMDF32~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM1B18~1.163\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMA45F~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMC0AD~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM9934~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM2971~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AME009~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMF946~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM15B7~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM3A5B~1.175\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM3E43~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM989B~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMFD52~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM1464~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM076B~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM0FD6~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM0112~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM814E~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM082E~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\assembly\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM5043~1.164\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM9AF0~1.163\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMCA4A~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM7B95~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM71C7~1.163\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM425B~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMD694~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMEE05~1.175\desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AM281C~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMAB03~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AME19A~1.163\Desktop.ini cmd.exe File opened for modification \??\c:\Windows\winsxs\AMB8AA~1.163\Desktop.ini cmd.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\c:\Windows\BITLOC~1\autorun.inf cmd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\dpapimig.exe cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\fms.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\tquery.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\migwiz\DLMANI~1\Microsoft-Windows-IE-InternetExplorer-DL.man cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\zipfldr.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\MCEWMDRMNDBootstrap.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\pl-PL\d2d1.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\rasplap.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\OEM\HOMEPR~3\license.rtf cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\RMActivate_ssp_isv.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\FunDisc.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\msobjs.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\migwiz\DLMANI~1\SchedSvc-DL.man cmd.exe File opened for modification \??\c:\Windows\SysWOW64\WINDOW~1\v1.0\fr-FR\pspluginwkr.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\wdi.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\taskmgr.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\remotepg.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\NlsData0020.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\netevent.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\C_864.NLS cmd.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\extrac32.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\sxstrace.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\Dism\fr-FR\LogProvider.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\attrib.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\DXPTaskRingtone.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\listsvc.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\msjint40.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\cmutil.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\mciqtz32.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\tracert.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\unregmp2.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\WerFault.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\RegisterIEPKEYs.exe cmd.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\wmiutils.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\rdvgumd32.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\setupapi.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\ntvdm64.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\iassvcs.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\ja-JP\wmiutils.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\INSTAL~1\setupdir\000e\_setup.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\aeevts.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\WINDOW~1\v1.0\it-IT\about_locations.help.txt cmd.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\msaatext.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\diskmgmt.msc cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\msacm32.drv.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\runonce.exe.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\wmidx.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\traffic.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\de-DE\PolicMan.mfl cmd.exe File opened for modification \??\c:\Windows\SysWOW64\softpub.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\en-US\win32_tpm.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\vdswmi.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\msobjs.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\p2pnetsh.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\napipsec.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\polstore.dll cmd.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\msv1_0.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\napdsnap.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\wmerror.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\es-ES\mstscax.mfl cmd.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\umpo.dll.mui cmd.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\Licenses\_Default\ENTERP~2\license.rtf cmd.exe File opened for modification \??\c:\Windows\SysWOW64\KBDFI1.DLL cmd.exe File opened for modification \??\c:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\PROGRA~1\COMMON~1\MICROS~1\ink\FSDEFI~1\symbols\symbase.xml cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\PICTUR~1.GAD\Images\tile_drop_shadow.png cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Data.Entity.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~2\COMMON~1\System\msadc\fr-FR\msdaprsr.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Data.Linq.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~1\INTERN~1\IEShims.dll cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\RSSFEE~1.GAD\ja-JP\settings.html cmd.exe File opened for modification \??\c:\PROGRA~1\WI0FCF~1\ja-JP\jnwdui.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~1\WI54FB~1\fr-FR\WMPDMC.exe.mui cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\RSSFEE~1.GAD\it-IT\js\RSSFeeds.js cmd.exe File opened for modification \??\c:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\System.IO.Log.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\images\settings_box_divider_left.png cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\WEATHE~1.GAD\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\MICROS~1\ink\tipresx.dll cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\System\msadc\msadds.dll cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\PERFOR~1\Notes_loop.wmv cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\es-ES\js\settings.js cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\es-ES\css\weather.css cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\PICTUR~1.GAD\en-US\css\settings.css cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\MICROS~1\ink\fr-FR\InkObj.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\System\ado\de-DE\msader15.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Full\pushplaysubpicture.png cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\de\PresentationBuildTasks.resources.dll cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Net.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\MICROS~1\STATIO~1\Genko_1.emf cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\circleround_glass.png cmd.exe File opened for modification \??\c:\PROGRA~1\INTERN~1\ieinstal.exe cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CURREN~1.GAD\images\row_over.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\MEDIAC~1.GAD\images\button_left_mouseout.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\PICTUR~1.GAD\es-ES\js\settings.js cmd.exe File opened for modification \??\c:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Data.Linq.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\PICTUR~1.GAD\ja-JP\js\settings.js cmd.exe File opened for modification \??\c:\PROGRA~1\INTERN~1\en-US\jsdbgui.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~2\Adobe\READER~1.0\Reader\Tracker\RECDE7~1.GIF cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\MICROS~1\ink\es-ES\InkObj.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\images\45.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CURREN~1.GAD\de-DE\js\currency.js cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\CLOCK~1.GAD\images\system_s.png cmd.exe File opened for modification \??\c:\PROGRA~3\MICROS~1\DEVICE~1\Task\{07DEB~1\pictures.ico cmd.exe File opened for modification \??\c:\PROGRA~3\MICROS~1\WINDOW~2\MSScan\WelcomeScan.jpg cmd.exe File opened for modification \??\c:\PROGRA~1\COMMON~1\MICROS~1\ink\hwrcatsh.dat cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\VIDEOW~1\videowall.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CALEND~1.GAD\images\bPrev-hot.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\en-US\settings.html cmd.exe File opened for modification \??\c:\PROGRA~2\WINDOW~1\WinMail.exe cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\PICTUR~1.GAD\Images\shuffle_over.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\SLIDES~1.GAD\es-ES\css\settings.css cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Travel\TravelIntroToMain_PAL.wmv cmd.exe File opened for modification \??\c:\PROGRA~1\WI0FCF~1\it-IT\JNTFiltr.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~1\WI54FB~1\es-ES\setup_wm.exe.mui cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\images\settings_corner_top_right.png cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\SLIDES~1.GAD\it-IT\js\slideShow.js cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\WEATHE~1.GAD\images\btn_close_down_BIDI.png cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\BabyBoy\BabyBoyScenesBackground.wmv cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\images\settings_right_pressed.png cmd.exe File opened for modification \??\c:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\images\docked_blue_snow.png cmd.exe File opened for modification \??\c:\PROGRA~2\COMMON~1\System\ado\msado20.tlb cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\System.RunTime.Serialization.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~2\COMMON~1\System\ado\ja-JP\msader15.dll.mui cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\ja\System.RunTime.Serialization.Resources.dll cmd.exe File opened for modification \??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.IdentityModel.dll cmd.exe File opened for modification \??\c:\PROGRA~2\WI4223~1\Gadgets\RSSFEE~1.GAD\de-DE\RSSFeeds.html cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\OmdProject.dll cmd.exe File opened for modification \??\c:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Full\1047x576black.png cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AMAA51~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AMF561~1.175\SPPWIN~1.XRM cmd.exe File opened for modification \??\c:\Windows\winsxs\AMCF88~1.163\Amd64\CNBIC4_8.DLL cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AM5E92~2.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AMAA3A~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AMC4FA~1.163\SETSPN~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X8212A~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AM08E7~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X856D4~1.MUI cmd.exe File opened for modification \??\c:\Windows\MICROS~1.NET\FRAMEW~2\V20~1.507\Microsoft.WinFX.targets cmd.exe File opened for modification \??\c:\Windows\winsxs\AM3A1B~1.163\speech.h1s cmd.exe File opened for modification \??\c:\Windows\winsxs\AMFB3D~1.163\Amd64\HPDJ5550.CFG cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AM39D5~2.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AM32E2~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AME59A~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AMC7F5~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AM7EB2~1.175\VSSSER~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AMF0DC~1.175\MANAGE~3.RES cmd.exe File opened for modification \??\c:\Windows\winsxs\AM7378~1.163\RDBSSS~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X85F86~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AM754D~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AM5B03~1.175\efscore.dll cmd.exe File opened for modification \??\c:\Windows\winsxs\AM0013~2.163\WINDOW~1.ADM cmd.exe File opened for modification \??\c:\Windows\winsxs\AM78A1~1.163\SELECT~2.GIF cmd.exe File opened for modification \??\c:\Windows\winsxs\AME7BD~2.163\WINSPO~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X87B61~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\Catalogs\DEC7FB~1.CAT cmd.exe File opened for modification \??\c:\Windows\winsxs\FileMaps\$$CA6B~1.CDF cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AMFE3F~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AM946A~1.MAN cmd.exe File opened for modification \??\c:\Windows\POLICY~1\de-DE\PerfCenterCPL.adml cmd.exe File opened for modification \??\c:\Windows\winsxs\AM2C5D~1.163\LOGPRO~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\AM7853~2.163\REPORT~1.XML cmd.exe File opened for modification \??\c:\Windows\Media\Festival\Windows Feed Discovered.wav cmd.exe File opened for modification \??\c:\Windows\winsxs\AM14C4~2.163\MSHTAE~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\AMD0BC~1.163\ADSNTD~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X8D351~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AM3A1A~1.163\BrEvIF.dll cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\AM0C44~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\Catalogs\827756~1.CAT cmd.exe File opened for modification \??\c:\Windows\winsxs\MANIFE~2\AMFE71~1.MAN cmd.exe File opened for modification \??\c:\Windows\winsxs\AM974D~1.163\FONTVI~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\AM30F2~1.163\ftpsvc.mfl cmd.exe File opened for modification \??\c:\Windows\winsxs\AMD4B2~1.163\MFWMAAEC.DLL cmd.exe File opened for modification \??\c:\Windows\winsxs\AM7099~1.163\NETWOR~1.ADM cmd.exe File opened for modification \??\c:\Windows\winsxs\AM18C3~1.163\TPMINI~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\FileMaps\$$05F5~1.CDF cmd.exe File opened for modification \??\c:\Windows\INSTAL~1\{90140~2\ShellUI.MST cmd.exe File opened for modification \??\c:\Windows\winsxs\AM4648~1.163\DVDUPG~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\AM3FF3~1.163\license.rtf cmd.exe File opened for modification \??\c:\Windows\winsxs\AM6181~1.163\rasman.dll cmd.exe File opened for modification \??\c:\Windows\winsxs\AM9F1D~1.163\WMALFX~1.DLL cmd.exe File opened for modification \??\c:\Windows\winsxs\AM569A~1.163\SAMIND~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\AM1A99~1.163\Amd64\CNB_0302.GPD cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X8B2D8~1.MUI cmd.exe File opened for modification \??\c:\Windows\PLA\Rules\Rules.System.Configuration.xml cmd.exe File opened for modification \??\c:\Windows\winsxs\AME728~1.163\urgent.cov cmd.exe File opened for modification \??\c:\Windows\winsxs\AME9DF~1.163\ISCSIC~1.MUI cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\X863CE~1.DLL cmd.exe File opened for modification \??\c:\Windows\winsxs\AMEDA3~1.163\HAL~1.INF cmd.exe File opened for modification \??\c:\Windows\winsxs\AM8F7C~2.163\artui.h1s cmd.exe File opened for modification \??\c:\Windows\winsxs\Backup\AM0B2D~1.EXE cmd.exe File opened for modification \??\c:\Windows\winsxs\AMF490~1.163\ABBEB9~1.TXT cmd.exe File opened for modification \??\c:\Windows\winsxs\AM7771~1.163\SCCLSD~1.MUI cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2496 wrote to memory of 572 2496 shell-x86.exe 30 PID 2496 wrote to memory of 572 2496 shell-x86.exe 30 PID 2496 wrote to memory of 572 2496 shell-x86.exe 30 PID 2496 wrote to memory of 572 2496 shell-x86.exe 30 PID 2496 wrote to memory of 3060 2496 shell-x86.exe 32 PID 2496 wrote to memory of 3060 2496 shell-x86.exe 32 PID 2496 wrote to memory of 3060 2496 shell-x86.exe 32 PID 2496 wrote to memory of 3060 2496 shell-x86.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\shell-x86.exe"C:\Users\Admin\AppData\Local\Temp\shell-x86.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Drops file in Drivers directory
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:572
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵PID:3060
-