Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2023 21:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89afd8eea2d64286b2fc6dcea4e3599a442c72d0641f624dac679a1e0f1821e2.dll
Resource
win7-20230831-en
windows7-x64
1 signatures
150 seconds
General
-
Target
89afd8eea2d64286b2fc6dcea4e3599a442c72d0641f624dac679a1e0f1821e2.dll
-
Size
2.6MB
-
MD5
468bbf0b760442459dbe98a19e4de912
-
SHA1
5b46da3eb600990b3b90587e760b1f328dd507b6
-
SHA256
89afd8eea2d64286b2fc6dcea4e3599a442c72d0641f624dac679a1e0f1821e2
-
SHA512
0b423de40d6f6c75617311dffe96d1a65057d76cf9fd724e3d4d6bd42f2062bc63242d85d4a2937208e3eca00ef6cb7c493f6cf6eecd4a37ad0a2f2a42f3273c
-
SSDEEP
49152:m315FDTi8KfLKREjS6nPUBndwJZbeQx5pXhEQTZ1lsc47vu+LFzXk7/50fz7UoGI:WrFoLKR2XUBndMyQBeu+RXk7/efz2I
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 648 759D.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 53 IoCs
description ioc Process File created C:\Windows\SysWOW64\mswstr10.dll 759D.tmp File created C:\Windows\SysWOW64\acwow64.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 759D.tmp File created C:\Windows\SysWOW64\mspbde40.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 759D.tmp File created C:\Windows\SysWOW64\expsrv.dll 759D.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 759D.tmp File created C:\Windows\SysWOW64\gnsdk_fp.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 759D.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 759D.tmp File created C:\Windows\SysWOW64\OneDriveSetup.exe 759D.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 759D.tmp File created C:\Windows\SysWOW64\d3dim.dll 759D.tmp File created C:\Windows\SysWOW64\ir32_32original.dll 759D.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 759D.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 759D.tmp File created C:\Windows\SysWOW64\msxbde40.dll 759D.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 759D.tmp File created C:\Windows\SysWOW64\ir50_32original.dll 759D.tmp File created C:\Windows\SysWOW64\msexch40.dll 759D.tmp File created C:\Windows\SysWOW64\olecli32.dll 759D.tmp File created C:\Windows\SysWOW64\msjet40.dll 759D.tmp File created C:\Windows\SysWOW64\msorcl32.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\opencl.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 759D.tmp File created C:\Windows\SysWOW64\AppVEntSubsystems32.dll 759D.tmp File created C:\Windows\SysWOW64\hh.exe 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 759D.tmp File created C:\Windows\SysWOW64\mfc40u.dll 759D.tmp File created C:\Windows\SysWOW64\mfc40.dll 759D.tmp File created C:\Windows\SysWOW64\crtdll.dll 759D.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 759D.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 759D.tmp File created C:\Windows\SysWOW64\d3d8.dll 759D.tmp File created C:\Windows\SysWOW64\d3dxof.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 759D.tmp File created C:\Windows\SysWOW64\rdvgogl32.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 759D.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 759D.tmp File created C:\Windows\SysWOW64\olesvr32.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 759D.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 759D.tmp File created C:\Windows\SysWOW64\iac25_32.ax 759D.tmp File opened for modification C:\Windows\SysWOW64\PrintConfig.dll 759D.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 759D.tmp File created C:\Windows\SysWOW64\ir41_32original.dll 759D.tmp File created C:\Windows\SysWOW64\msjtes40.dll 759D.tmp File created C:\Windows\SysWOW64\msrepl40.dll 759D.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso40UIwin32client.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ExtendScript.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll 759D.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolap.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\rt3d.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 759D.tmp File opened for modification C:\Program Files\7-Zip\7z.sfx 759D.tmp File opened for modification C:\Program Files\7-Zip\7zCon.sfx 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\IEAWSDC.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\MSVCR110.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolui.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAME.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Csi.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msoshext.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOIDCLIL.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONLNTCOMLIB.DLL 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll 759D.tmp File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL 759D.tmp File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 759D.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\EmbeddedBrowserWebView.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIB.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll 759D.tmp File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OLKFSTUB.DLL 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGM.dll 759D.tmp File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 759D.tmp File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\msedgeupdate.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcr120.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 759D.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll 759D.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSCOPY.DLL 759D.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_bho.dll 759D.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 759D.tmp File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\adoberfp.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ScCore.dll 759D.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api 759D.tmp -
Drops file in Windows directory 62 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll 759D.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll 759D.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico 759D.tmp File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll_Apollo 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SaveAsRTF.api_NON_OPT 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rt3d.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logsession.dll 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico 759D.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Accessibility.api_NON_OPT 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Flash.mpp 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroForm.api__NON_OPT 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Search.api 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico 759D.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adoberfp.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvDX9.x3d 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ReadOutLoud.api 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Annots.api 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\sqlite.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QuickTime.mpp 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d 759D.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\NAPCRYPT.DLL 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\concrt140.dll_x86 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Bib.dll_NON_OPT 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\PPKLite.api 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrocef.exe.15EE1C08_ED51_465D_B6F3_FB152B1CC435 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\MCIMPP.mpp 759D.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Ace.dll_NON_OPT 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EScript.api 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Multimedia.api_NON_OPT 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDF.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll 759D.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SendMail.api 759D.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico 759D.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2040 rundll32.exe 2040 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2040 2200 rundll32.exe 85 PID 2200 wrote to memory of 2040 2200 rundll32.exe 85 PID 2200 wrote to memory of 2040 2200 rundll32.exe 85 PID 2040 wrote to memory of 648 2040 rundll32.exe 87 PID 2040 wrote to memory of 648 2040 rundll32.exe 87 PID 2040 wrote to memory of 648 2040 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\89afd8eea2d64286b2fc6dcea4e3599a442c72d0641f624dac679a1e0f1821e2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\89afd8eea2d64286b2fc6dcea4e3599a442c72d0641f624dac679a1e0f1821e2.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\759D.tmpC:\Users\Admin\AppData\Local\Temp\759D.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD58cb41a63060adbf0bded6a9394405e2f
SHA176fcdf41f72b55201af9d9b0a694080349bc4c01
SHA2561023539f6df1ab9404837d5051618274e6aebf26c7c184eccfa1fd21a9ee2f3a
SHA5126f1117fc900cfe1eac0136872916d44c8bc00ac2f11def0e3822fb53ba9cc6876f43214d5f6bd8d20dec27bd52ac8a402b56ccc3042ab28e2dafa3320810597f
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666