Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0118ea17cbe6a0f2bd0985f811a3b6ac.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0118ea17cbe6a0f2bd0985f811a3b6ac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0118ea17cbe6a0f2bd0985f811a3b6ac.exe
-
Size
7.0MB
-
MD5
0118ea17cbe6a0f2bd0985f811a3b6ac
-
SHA1
a7644101cf8fec8fafab49f6fe71f12b6ab9a1e1
-
SHA256
1632ecd4987e685397424bd3f6a44dd31c75c5b12f9a3b77573d216f53761d69
-
SHA512
5a33ebc21be432eee5db0156e13dfd3beab6e24a8b6f51cb8e4f2300c1ddfe7597aed5b8dd4b2af7c7edecf51b951eff065b3f528ea84914127b2431dead14d7
-
SSDEEP
49152:0qN+V8tgJdf7rOO53RTqtiGydB3I3pP9zWmTW:1+Cgl7rOO53mWC3pP8
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 0118ea17cbe6a0f2bd0985f811a3b6ac.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 0118ea17cbe6a0f2bd0985f811a3b6ac.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\write.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\cipher.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\where.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\net.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\SetIEInstalledDate.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMig.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\comp.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\user.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\wininit.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\regini.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\runas.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\syskey.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\SysWOW64\dccw.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jre7\bin\kinit.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jre7\bin\unpack200.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jre7\bin\orbd.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\7-Zip\7z.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Microsoft Games\Hearts\Hearts.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-downlevel.binaries_31bf3856ad364e35_6.3.9600.16428_none_5faf8886ff3d65d0\MsSpellCheckingFacility.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\wsmprovhost.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\WMIADAP.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_3e69140a61f1eff5\hdwwiz.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ehrecvr.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-international-core_31bf3856ad364e35_6.1.7600.16385_none_459f562ff37206dd_muiunattend.exe_1e11bb40 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\aspnet_regbrowsers.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\find.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_af500e3c7fc49bc4\wuapp.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\bb4a1994db088e84b9d383271b082250\dfsvc.ni.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\ehome\mcspad.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-irftp_31bf3856ad364e35_6.1.7600.16385_none_b2af329397f29f60\irftp.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\rrinstaller.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_55d820d53d0a8fa3\wlanext.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_7b0d6f67c2d3f97a\iexplore.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigSetup.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_6.1.7600.16385_none_47357ddedbb9dec6\logagent.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_3fbc74d90a6e33f8\NetProj.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d\printui.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\ehome\ehmsas.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_6.1.7600.16385_none_a749cec7a8b6bf08\wbadmin.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\logoff.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63\auditpol.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_0f797e18d8361ef2\cttune.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_5702948e8e63fc30\wecutil.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_df46d976c8a5880b\InetMgr6.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_dc2a59723dcfa2c7\RmClient.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_6.1.7601.17514_none_08e183f8dd5f48b7\smi2smir.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\aspnet_regiis.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496_wowreg32.exe_94fc2d06 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.2.9600.16428_none_a827c83273877b14\ie4uinit.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_33e01c5875c2e5cb\iscsicpl.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a_winresume.exe_85cd1215 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_6.1.7600.16385_none_f5b8f3d6a353fa89\SnippingTool.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661_smss.exe_d7209c3a 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\servicing\TrustedInstaller.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_eace14b8d6178cca\SetIEInstalledDate.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmUi.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.17514_none_a1636a92177e3020\prevhost.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe$ 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_4afdc98b09e3cfe8\PkgMgr.exe 0118ea17cbe6a0f2bd0985f811a3b6ac.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_fed8c13f0d90a8cf_winmgmt.exe_8f8eb7b1 0118ea17cbe6a0f2bd0985f811a3b6ac.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 0118ea17cbe6a0f2bd0985f811a3b6ac.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1752 0118ea17cbe6a0f2bd0985f811a3b6ac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0118ea17cbe6a0f2bd0985f811a3b6ac.exe"C:\Users\Admin\AppData\Local\Temp\0118ea17cbe6a0f2bd0985f811a3b6ac.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5ca37b042cd98f3cb3a9cb7d67d73027d
SHA1fe4db73aa6e2ed25d6db3783884e96ea7b669be2
SHA256d3cf1a7ff26ff710b133a0f77b91fe7475befed80e7c6a719132465a9646bcec
SHA5124ea7a1ff020db5764f26cb1c5cc4dfc3eac59d8a4a44b4c834beee304fd3a98cb5a204cd52f9683a83265f6b72a7b9a6c2749d7cb5685844ad3abfcdad3e7b21