Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 15:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7b1de39c8d3cd15189d12e0c4753940.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7b1de39c8d3cd15189d12e0c4753940.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b7b1de39c8d3cd15189d12e0c4753940.exe
-
Size
2.1MB
-
MD5
b7b1de39c8d3cd15189d12e0c4753940
-
SHA1
26060e7020a038bef1d04052b61d9eb18bfd225e
-
SHA256
423c43d3ae10ee33f43e7f1b78b716d691011203d29382ebd5280e7f06e3e5b5
-
SHA512
b674d0ada4244c001b4c8d5c2c79419d32a1579177873358003e2c7aea6321c5b2c7a844ea2519100b109cf08c05cc0ff860fd6eedf9dab22886e70cc89d5908
-
SSDEEP
49152:E3lg00g7mM+M6RkMkIM7I067Z8xmN3Aek03noj45wlDT:nM+M6RkMkIM7SeUJF3noxD
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" b7b1de39c8d3cd15189d12e0c4753940.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b7b1de39c8d3cd15189d12e0c4753940.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\calc.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\userinit.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\newdev.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\takeown.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\vssadmin.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\taskeng.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\diantz.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\finger.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\at.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\findstr.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\PING.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\dnscacheugc.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\choice.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\setup16.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\wuapp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\fontview.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\cacls.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\cmd.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\dialer.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\winrs.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\compact.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\fc.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe b7b1de39c8d3cd15189d12e0c4753940.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jre7\bin\klist.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jre7\bin\keytool.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7601.17514_none_a54b31331066c8e2\Dxpserver.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrm.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\posix.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_wpf-presentationhostexe_31bf3856ad364e35_6.2.7601.17514_none_96490604d588c19b\PresentationHost.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_bb95e7e51189d8f9\netsh.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.2.9600.16428_none_caf2ec2ca6b08f27\ieinstal.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qappsrv.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\mofcomp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6_netbtugc.exe_825f4f74 b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7601.17514_none_b296f701dc00c582\ieUnatt.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_acd03d9b9048bd78\mscorsvw.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_6.1.7601.17514_none_e8f86b1cdf02c483\wpnpinst.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_6.1.7600.16385_none_a9b5c1d91f03e0b4\RelPost.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-downlevel.binaries_31bf3856ad364e35_6.3.9600.16428_none_5faf8886ff3d65d0\MsSpellCheckingFacility.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_2d02b12c3d47a517\sbunattend.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidpolicyconverter.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..e-managed-regmceapp_31bf3856ad364e35_6.1.7600.16385_none_b13a0967547ecab4\RegisterMCEApp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcweblauncher_31bf3856ad364e35_6.1.7600.16385_none_5846a8771b202706\MediaCenterWebLauncher.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\ehome\RegisterMCEApp.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_55d820d53d0a8fa3\wlanext.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickLearningWizard.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSUNATD.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_6.1.7601.17514_none_f8852afc12f84e8e\nltest.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\SvcIni.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_76239aafb364e805_rasautou.exe_477abe34 b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\ehExtHost.ni.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_6.1.7600.16385_none_4c045ec8fda52d34\fveprompt.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\migwiz.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_8ee34c400d95f0ab\psr.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXWiz.exe b7b1de39c8d3cd15189d12e0c4753940.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\ehome\loadmxf.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17514_none_d281ccc018b94ff4\conhost.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\doskey.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\typeperf.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFontCac#\0246845f487e5f33d3564eff578665a3\PresentationFontCache.ni.exe$ b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_252d34f00303c6fa\Robocopy.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_6.1.7600.16385_none_e63ed98817cf16b1\Eap3Host.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gettingstarted_31bf3856ad364e35_6.1.7600.16385_none_dc7256ed0ded6c12\GettingStarted.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ShapeCollector.exe b7b1de39c8d3cd15189d12e0c4753940.exe File opened for modification C:\Windows\winsxs\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_6.1.7601.17514_none_40fc6e6d1b4ea992\ServiceModelReg.exe b7b1de39c8d3cd15189d12e0c4753940.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b7b1de39c8d3cd15189d12e0c4753940.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2980 b7b1de39c8d3cd15189d12e0c4753940.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7b1de39c8d3cd15189d12e0c4753940.exe"C:\Users\Admin\AppData\Local\Temp\b7b1de39c8d3cd15189d12e0c4753940.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b7b1de39c8d3cd15189d12e0c4753940
SHA126060e7020a038bef1d04052b61d9eb18bfd225e
SHA256423c43d3ae10ee33f43e7f1b78b716d691011203d29382ebd5280e7f06e3e5b5
SHA512b674d0ada4244c001b4c8d5c2c79419d32a1579177873358003e2c7aea6321c5b2c7a844ea2519100b109cf08c05cc0ff860fd6eedf9dab22886e70cc89d5908