Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 12:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b75a74323b1d72453d486e0096950183.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b75a74323b1d72453d486e0096950183.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b75a74323b1d72453d486e0096950183.exe
-
Size
2.6MB
-
MD5
b75a74323b1d72453d486e0096950183
-
SHA1
a5faa799517c69f986a0d5627f8e0d0d9602047f
-
SHA256
767cf7c577babf8b576010eddd229f04066139b3cf1b8bbe7674aebacf4de34b
-
SHA512
1bc38ef5598de57bd56be0987684d12a0060a3b5ed3579f47537827f3772fd4f080929fcb5196a1dc756d7b4cc5f5fff4b09a1114e902c318e456d3601759ac2
-
SSDEEP
49152:fYPYPrRokpyftlj4oJdXN0BMOwLloBrugt:7rRokc7JdXN0B7+s7
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" b75a74323b1d72453d486e0096950183.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b75a74323b1d72453d486e0096950183.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\perfmon.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\where.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\migwiz\migwiz.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\convert.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\wusa.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\verifier.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\cacls.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\notepad.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\migwiz\MigSetup.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\runas.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\winver.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\finger.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\printui.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\SysWOW64\secinit.exe b75a74323b1d72453d486e0096950183.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe$ b75a74323b1d72453d486e0096950183.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE b75a74323b1d72453d486e0096950183.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe$ b75a74323b1d72453d486e0096950183.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe$ b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Microsoft Games\Hearts\Hearts.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE$ b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE$ b75a74323b1d72453d486e0096950183.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe$ b75a74323b1d72453d486e0096950183.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\doskey.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_6.1.7600.16385_none_a044d905576812d4\odbcad32.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setx_31bf3856ad364e35_6.1.7600.16385_none_086bc77632c16995\setx.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\user.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_38dc646bf68909f4\cmdkey.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_unlodctr.exe_69df45bb b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_316a8a208c030e56\reg.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_934d08d31b96d4ee\msra.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_58ca66f699d77ff1\xwizard.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_25545528bd642170\taskkill.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPUEX.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_7b0d6f67c2d3f97a\iexplore.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\typeperf.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7601.17514_none_7288349cbfd37b08\taskmgr.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\PnPutil.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua_31bf3856ad364e35_6.1.7601.17514_none_047062a1736af5b9_consent.exe_9075a1c2 b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\IMEPADSV.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\HOSTNAME.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_1c92c4d88ce86757\wmprph.exe b75a74323b1d72453d486e0096950183.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe b75a74323b1d72453d486e0096950183.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_a82ee2a7319fa8f8\ipconfig.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\find.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\MRINFO.EXE b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\ehome\wow\ehexthost32.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\ditrace.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_3e69140a61f1eff5\hdwwiz.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\print.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe$ b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_af07fb6876def437\wusa.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_28198854bba53a00\tasklist.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe b75a74323b1d72453d486e0096950183.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\mcbuilder.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_wvmic.inf_31bf3856ad364e35_6.1.7601.17514_none_6007c443630c03aa\vmicsvc.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81\iscsicli.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_3eb101caec1acc2c\ie4uinit.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\diskperf.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\eudcsettings.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_f9aeffb75a698a7f\RpcPing.exe b75a74323b1d72453d486e0096950183.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_cb9353551bbd8ed8\DevicePairingWizard.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_125aa78894e49f8f\waitfor.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_c405852b31194b0b\certreq.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86\iscsicli.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_33fa4336c49b998b\rundll32.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_3e69140a61f1eff5_hdwwiz.exe_b6a1c2df b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigSetup.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_ddef5417d55eb944\aspnet_regbrowsers.exe b75a74323b1d72453d486e0096950183.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_b45109ec45a678fc\WFServicesReg.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe b75a74323b1d72453d486e0096950183.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe b75a74323b1d72453d486e0096950183.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b75a74323b1d72453d486e0096950183.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2836 b75a74323b1d72453d486e0096950183.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b75a74323b1d72453d486e0096950183.exe"C:\Users\Admin\AppData\Local\Temp\b75a74323b1d72453d486e0096950183.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5b75a74323b1d72453d486e0096950183
SHA1a5faa799517c69f986a0d5627f8e0d0d9602047f
SHA256767cf7c577babf8b576010eddd229f04066139b3cf1b8bbe7674aebacf4de34b
SHA5121bc38ef5598de57bd56be0987684d12a0060a3b5ed3579f47537827f3772fd4f080929fcb5196a1dc756d7b4cc5f5fff4b09a1114e902c318e456d3601759ac2