Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1007ba533a69...53.exe
windows7-x64
107ba533a69...53.exe
windows10-2004-x64
10e971ff0e7...8d.exe
windows7-x64
80e971ff0e7...8d.exe
windows10-2004-x64
8111fb06de8...8b.exe
windows7-x64
9111fb06de8...8b.exe
windows10-2004-x64
92de3cea3eb...a8.exe
windows7-x64
12de3cea3eb...a8.exe
windows10-2004-x64
1327a2a4916...ca.exe
windows7-x64
8327a2a4916...ca.exe
windows10-2004-x64
836c10a3e1f...d9.exe
windows7-x64
136c10a3e1f...d9.exe
windows10-2004-x64
867bf260c3e...10.exe
windows7-x64
867bf260c3e...10.exe
windows10-2004-x64
870ec1874cf...ac.exe
windows7-x64
170ec1874cf...ac.exe
windows10-2004-x64
1817f5b0fcc...99.exe
windows7-x64
7817f5b0fcc...99.exe
windows10-2004-x64
7875a6185aa...f0.exe
windows7-x64
1875a6185aa...f0.exe
windows10-2004-x64
1887d386d2e...c6.exe
windows7-x64
1887d386d2e...c6.exe
windows10-2004-x64
1902afe35c6...16.exe
windows7-x64
10902afe35c6...16.exe
windows10-2004-x64
1097b6e51df2...0a.exe
windows7-x64
797b6e51df2...0a.exe
windows10-2004-x64
7a4704be3a7...72.exe
windows7-x64
1a4704be3a7...72.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b75b3ff656...52.exe
windows7-x64
8b75b3ff656...52.exe
windows10-2004-x64
8Analysis
-
max time kernel
449s -
max time network
454s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 14:39
Behavioral task
behavioral1
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
600 seconds
Behavioral task
behavioral2
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
600 seconds
Behavioral task
behavioral4
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral5
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
600 seconds
Behavioral task
behavioral6
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral7
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
600 seconds
Behavioral task
behavioral10
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral13
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral14
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral15
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
600 seconds
Behavioral task
behavioral16
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral17
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
600 seconds
Behavioral task
behavioral18
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral19
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral20
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral21
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
600 seconds
Behavioral task
behavioral24
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
23 signatures
600 seconds
Behavioral task
behavioral25
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
600 seconds
Behavioral task
behavioral26
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral27
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
600 seconds
Behavioral task
behavioral28
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral29
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral30
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
600 seconds
Behavioral task
behavioral31
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
600 seconds
Behavioral task
behavioral32
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
600 seconds
General
-
Target
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
-
Size
662KB
-
MD5
b6c70f89f19670923f3f490ed5331395
-
SHA1
24c9df54d779be27508203666dc48a3fdabb0b87
-
SHA256
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b
-
SHA512
8a49a73c4086be3ae657452816070d7bf79dc653a9a7c783262348788ee80584c4456e3056f1427f4f1b8433de54437b996bfbede100430b2f7168c130511b0b
-
SSDEEP
12288:IG86nitqrIT6Eqk56i258EJsUQUUJ9LBHd2Uo:57itqr3e6d18J9LBHd2n
Score
9/10
Malware Config
Signatures
-
Renames multiple (3031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Web\Wallpaper\Theme2\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Libraries\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Searches\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Contacts\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\3D Objects\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Offline Web Pages\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Desktop\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created F:\$RECYCLE.BIN\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\OneDrive\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Downloaded Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\AccountPictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\12520437.cpx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\12520850.cpx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\@AppHelpToast.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\@AudioToastIcon.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Photo Viewer\PhotoBase.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\en-US_female_TTS\platform_format.lua 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3803511929-1339359695-2191195476-1000-MergedResources-0.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\MedTile.scale-100.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\MedTile.scale-100.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MsiProvider.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-100.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroSup64.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\THMBNAIL.PNG 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\msedgeupdateres_lb.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\LICENSE 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\adcjavas.inc 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\System\wab32.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-125.jpg 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-100_contrast-white.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdaer.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-processthreads-l1-1-1.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.DLL 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\msedgeupdateres_uk.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-100.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-125.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\msedgeupdateres_lo.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\LargeTile.scale-125.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-100.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\classlist 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ir.idl 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-100.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PackageManagement.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\PLA\Reports\Report.System.Common.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.SecureBoot.Commands.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\Logs\MoSetup\ActionList.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_it_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\AllowAll.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\rescache\_merged\24768367\3460651218.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\Microsoft.ConfigCI.Commands.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\schemas\TSWorkSpace\tswcx.xsd 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\sysglobl.Resources\2.0.0.0_es_b03f5f7f11d50a3a\sysglobl.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Outlook.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\jsc.resources\v4.0_10.0.0.0_de_b03f5f7f11d50a3a\JSC.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\rescache\_merged\3937681233\3076101447.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\Microsoft.WSMan.Runtime.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Dtc.PowerShell\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Dtc.PowerShell.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\Microsoft.Tpm.Commands.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\687a0140ccc03a6ccf55dc3b9cb08148\Microsoft.PowerShell.Security.Activities.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_it_b77a5c561934e089\mscorlib.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Web\4K\Wallpaper\Windows\img0_1024x768.jpg 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\rescache\_merged\482193516\3433537698.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regsql.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\aspnet_regsql.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\scheduled\Maintenance\CL_Utility.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Graph.config 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\17e8d62f031d58fe723473a6a11c4ad1\Microsoft.PowerShell.Security.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\System.Configuration.Install.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities.Resources\v4.0_3.0.0.0_ja_31bf3856ad364e35\Microsoft.PowerShell.Activities.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Provisioning\categories.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ImmersiveControlPanel\appxsignature.p7x 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\security\ApplicationId\PolicyManagement\AppIdPolicy.xsd 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\rescache\_merged\2879188601\3675631199.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System\a67e70d6e6bdcf4ac31a986148d455c4\System.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\debug\sammui.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.Resources\v4.0_1.0.0.0_ja_31bf3856ad364e35\Microsoft.Management.Infrastructure.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\6de9117021f804bd643639bb684ffe6f\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\Microsoft.Management.Infrastructure.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\rescache\_merged\3983011459\2293221954.pri 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Drawing.Design.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Drawing.Design.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Resources\3.5.0.0_ja_b77a5c561934e089\System.Data.Entity.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Resources\3.5.0.0_it_b77a5c561934e089\System.Data.Entity.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\69042cc33a9bcc563ab9ff90a7276b2c\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\Microsoft.Ink.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.Resources\3.5.0.0_it_b77a5c561934e089\System.Data.Entity.Design.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Microsoft.NET\Framework64\sbscmp10.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 5940 2496 WerFault.exe 16 6220 2496 WerFault.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 92962⤵
- Program crash
PID:5940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 189642⤵
- Program crash
PID:6220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2496 -ip 24961⤵PID:6924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2496 -ip 24961⤵PID:6864