Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 14:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
472a3cc2ffde5620522de1e6cd81f725.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
472a3cc2ffde5620522de1e6cd81f725.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
472a3cc2ffde5620522de1e6cd81f725.exe
-
Size
190KB
-
MD5
472a3cc2ffde5620522de1e6cd81f725
-
SHA1
b6f49c45cca7a57123dd63c676cff26289997736
-
SHA256
cff90b4dd892804b2200a49fd9f35a5441f89611065101be582e3a02a7b668e9
-
SHA512
c4409b314840fa20230dcafc11cdaa151c60263e957cb541c4671defd13509beaf0543c3a9a515cf7a396a956a24112156ff4953af18f33c7943c1646358acac
-
SSDEEP
3072:08nVh2ebWslb5r8P+0kizv6ODHt/OE9sPGk3U8kTQVUrMz9:NVPWslyPlxPDHt/OEw59z9
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 472a3cc2ffde5620522de1e6cd81f725.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 472a3cc2ffde5620522de1e6cd81f725.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clip.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\dnscacheugc.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\net1.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\relog.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\proquota.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\Dism.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\dccw.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\net.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\drvinst.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\where.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\DeviceProperties.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\vssadmin.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\certreq.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\winver.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\com\comrepl.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\osk.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe 472a3cc2ffde5620522de1e6cd81f725.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{675AAB6F-F199-48FF-9464-90FEDD351C57}\chrome_installer.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jre7\bin\klist.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jre7\bin\orbd.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\7-Zip\7zFM.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE$ 472a3cc2ffde5620522de1e6cd81f725.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\ehome\ehsched.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\PresentationFontCache.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\NETFXRepair.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\ehExtHost.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\LoadMxf.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 472a3cc2ffde5620522de1e6cd81f725.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe$ 472a3cc2ffde5620522de1e6cd81f725.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 472a3cc2ffde5620522de1e6cd81f725.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 472a3cc2ffde5620522de1e6cd81f725.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1228 472a3cc2ffde5620522de1e6cd81f725.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\472a3cc2ffde5620522de1e6cd81f725.exe"C:\Users\Admin\AppData\Local\Temp\472a3cc2ffde5620522de1e6cd81f725.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD57d6b9031280294ea27867d063fff406d
SHA1f39a3597a4bcdca2129af510148e08e09c497ca2
SHA256049e967f1827d537cc7a398560eee5a22b714469b512078be4cec88fa6ac0d7c
SHA5128b7e778acce72f8b14d9528e6cbd94d9b2d0e98a101e1797751b78ac8a163c0159879b4c9fcf026c5e283450f7f0d57a046eade802ba9d517d568b81c2521968