Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7ca0c079bd39cbf1526c7f0c5040fd7.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7ca0c079bd39cbf1526c7f0c5040fd7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b7ca0c079bd39cbf1526c7f0c5040fd7.exe
-
Size
3.1MB
-
MD5
b7ca0c079bd39cbf1526c7f0c5040fd7
-
SHA1
ce1d04495b871635a3526ec24aa84b6295b98053
-
SHA256
d78fc484d69d7d2fb0f0d29376c8901f1230aec74060243095f638d46a7c2a0e
-
SHA512
c2472f53583667bc3a9bf085015f4acefe2020721ebec85942a07087a085ba31e158d874f4054430ed99bf804faf61f85e42c3d36d6eff12cbe7ae2a667ac400
-
SSDEEP
49152:Iss1TPakOElMaFLkJhKPgssSt2gpZqhaK6zbfqdl:sNak7Mhv7Stjx
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" b7ca0c079bd39cbf1526c7f0c5040fd7.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b7ca0c079bd39cbf1526c7f0c5040fd7.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\curl.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\Dism.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\psr.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\recover.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\takeown.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\attrib.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\write.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\userinit.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\msdt.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\raserver.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\print.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesRemote.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\label.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\resmon.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\WWAHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\secinit.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\setup16.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\notepad.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\runas.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\charmap.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\makecab.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeComRegisterShellARM64.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\7-Zip\7z.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateBroker.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE b7ca0c079bd39cbf1526c7f0c5040fd7.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\PrintDialog\PrintDialog.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe b7ca0c079bd39cbf1526c7f0c5040fd7.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b7ca0c079bd39cbf1526c7f0c5040fd7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4376 b7ca0c079bd39cbf1526c7f0c5040fd7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ca0c079bd39cbf1526c7f0c5040fd7.exe"C:\Users\Admin\AppData\Local\Temp\b7ca0c079bd39cbf1526c7f0c5040fd7.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5b7ca0c079bd39cbf1526c7f0c5040fd7
SHA1ce1d04495b871635a3526ec24aa84b6295b98053
SHA256d78fc484d69d7d2fb0f0d29376c8901f1230aec74060243095f638d46a7c2a0e
SHA512c2472f53583667bc3a9bf085015f4acefe2020721ebec85942a07087a085ba31e158d874f4054430ed99bf804faf61f85e42c3d36d6eff12cbe7ae2a667ac400