Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3fe160eeeaafeabb355124043bccda5.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3fe160eeeaafeabb355124043bccda5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d3fe160eeeaafeabb355124043bccda5.exe
-
Size
8.7MB
-
MD5
d3fe160eeeaafeabb355124043bccda5
-
SHA1
b37a9fc6f4b77b0d5f7932ef4ec8e13c5f771e3f
-
SHA256
61144a1aad3394a9380366fa97f481e66dc083a1ad0715995420b29c81e85a5d
-
SHA512
79f2aaca952d09ebd64886fe189076dddd4e6f6f47c8c7e2e16a10f1191e37fa5461fef922d7d4ab5fdca73d0f273c645a749771d86335b6f1345d9009b70abe
-
SSDEEP
49152:T+++++Xrlj4hKPgssSt2gOfgitQMZgdeKVQkUbcokNnMzq:C+hv7St4giod9oq
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" d3fe160eeeaafeabb355124043bccda5.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf d3fe160eeeaafeabb355124043bccda5.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\credwiz.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\DeviceProperties.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\LocationNotifications.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\mshta.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\fc.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMig.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\cipher.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\ftp.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\migwiz\migwiz.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\certreq.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\migwiz\mighost.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\getmac.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\cmd.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\dialer.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\diantz.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\autochk.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\label.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\cttune.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\comp.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\drvinst.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\expand.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\hh.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\charmap.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\clip.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\dccw.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe d3fe160eeeaafeabb355124043bccda5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\ConfirmUnlock.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jre7\bin\kinit.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Mozilla Firefox\updater.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe d3fe160eeeaafeabb355124043bccda5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\ehome\ehrecvr.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe$ d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe$ d3fe160eeeaafeabb355124043bccda5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\ehome\McxTask.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe d3fe160eeeaafeabb355124043bccda5.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe d3fe160eeeaafeabb355124043bccda5.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf d3fe160eeeaafeabb355124043bccda5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2536 d3fe160eeeaafeabb355124043bccda5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3fe160eeeaafeabb355124043bccda5.exe"C:\Users\Admin\AppData\Local\Temp\d3fe160eeeaafeabb355124043bccda5.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.5MB
MD58e361aecaa1ca150bb184009d1b5eb6e
SHA1aec68369f4c7384fc46e357f17b1104aecb054e0
SHA256533f653aff1cb3fc0b56d1aa6c3121433beb010573effbd3784ee429cabd9cc6
SHA5122b2a9329bd70c348a8f66b4998c7d2879267cd63aafec217d658fbd74723622674931a2e96b55b37a37b1b41e2acf657a2d92484d4d8e66d66a42decd3861cbc