Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe
-
Size
755KB
-
MD5
5496582c7c3da3246ad732acf85e87a5
-
SHA1
ba3c35a73f77992c2927492a79038373b710bded
-
SHA256
8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4
-
SHA512
6c7b7d3fdc27c319e36ca3889b4db169516c848a34597a0bd7e7454312e7a86220c5ae131deff24724ab82b70adf3f66507f1d98414d55f3468120b5ba82395b
-
SSDEEP
6144:/wynAtMrOVRkidy9yIGWlUidywzYDteYIpREZP/xkNbyjUWAZyVVp+k:/wKfOVRo9yRY/ywzYDteYIpRE9eqVsk
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe" 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe" 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe -
Drops file in Program Files directory 37 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\RCX4984.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX5435.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\RCX3FCB.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Internet Explorer\en-US\ieinstalInternet11.00.19041.1.160101.0800.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\AdobeWCChromeNativeMessagingHost.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogSessionAcrobat.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AcrobatAdobe.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\RCX36DF.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCX370F.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\RCX3FDC.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AdobeAdobe.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogSessionJP2KLib.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX6724.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\WindowsmshwLatin.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfoMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\RCX3FEC.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\RCX4954.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX54F1.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAcrobat19.8.20071.303822.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\SistemaMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\ieinstaliexplore.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\MicrosoftSystem.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\AdobeAdobe.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX5E59.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Windows Mail\WABMIGWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFBrowser.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\NPPDF32Adobe.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogSessionJP2KLib.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\SistemaMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfoMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX5DEB.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCX533A.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogSessionAcrobat.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCX4905.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\AdobeWCChromeNativeMessagingHost.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Windows Mail\WABMIGWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\RCX372F.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-h..hextensions-desktop_31bf3856ad364e35_10.0.19041.746_none_d2fd55f11442594b\SystemWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\RCX52D3.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\RCX9BC3.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\fr\visualbasicmicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_netfx4-mscordacwks_dll_b03f5f7f11d50a3a_4.0.15805.0_none_e7091e11f3bd1369\MicrosoftFramework.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui.resources_31bf3856ad364e35_10.0.19041.1_de-de_3bace266522fbb03\TWINUIWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6acc9b918cd7cb00\clfsOperating.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Linq.Resources\3.5.0.0_ja_b77a5c561934e089\resourcesresources.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\e7dd774251db1abf49179f2d4e109684\EventViewerWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_isymwrapper_b03f5f7f11d50a3a_4.0.15805.0_none_63610988fe49a534\FrameworkISymWrapper340.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui.resources_31bf3856ad364e35_10.0.19041.1_it-it_714881890b38b44d\MicrosoftWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\ja\TasksMSBuild.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..redexperiences-rome_31bf3856ad364e35_10.0.19041.1_none_afeae6badab8ec17\WindowsOperating10.0.19041.1.160101.0800.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_dual_net8192se64.inf_31bf3856ad364e35_10.0.19041.1_none_c4ca59da8d54596e\RTL81892SEnet8192se64.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde.resources_31bf3856ad364e35_10.0.19041.1_it-it_c85c9dfa29ac4eaf\operativoSistema.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\msil_microsoft.windows.d..diaginput.resources_31bf3856ad364e35_10.0.19041.1_en-us_8418c1b8d2d6375f\MicrosoftGetDiagInput.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\RCX5274.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\RCX9C03.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.dsc.proxy.resources_31bf3856ad364e35_10.0.19041.1_en-us_d2f952256967d0fe\MicrosoftOperating10.0.19041.1.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\msil_system.serviceprocess_b03f5f7f11d50a3a_10.0.19041.1_none_15e6787f0d94dab1\ServiceProcessMicrosoft2.0.50727.91496.0507279100.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msls31_31bf3856ad364e35_11.0.19041.1_none_c0370664e10be438\Servicesmsls31.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.whea.cmdlets_31bf3856ad364e35_10.0.19041.1_none_a614d743cc31585a\WindowsWheaMemoryPolicy10.0.19041.1.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\es-ES\RCXE2D2.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..y-ntmarta.resources_31bf3856ad364e35_10.0.19041.1_it-it_cc498eb043d99253\Windowsoperativo.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\msil_microsoft.windows.d..telemetry.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d3def4aa725a2353\resourcesWriteDiagTelemetry.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\SystemWorkflow.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\1033\RCX2ED3.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.19041.1081_none_e9c4bc0774dd1b98\SPFILEQMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_b56a6cb5e1512e68\IEXPLOREiexplore.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.19041.1_none_cf2e206a40e77a2c\Microsoftmp4sdmod10.0.19041.1.160101.0800.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..daptercim.resources_31bf3856ad364e35_10.0.19041.1_de-de_0d05d7513d5a6504\WindowsMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_58e8f7e62ee6159d\MicrosoftWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\MicrosoftWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ndservice.resources_31bf3856ad364e35_10.0.19041.1_it-it_197fd21ccc8a2cbb\PlaySoundServiceMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..inrt-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_6dd06b57074d7979\BetriebssystemPrinting10.0.19041.1.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f12-f12appframe2_31bf3856ad364e35_11.0.19041.84_none_288cedec4171e340\F12AppFrame2Internet.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..otect-dll.resources_31bf3856ad364e35_10.0.19041.1_de-de_a99bf8e5b466f7b0\mskeyprotectBetriebssystem10.0.19041.1.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..torserver.resources_31bf3856ad364e35_10.0.19041.1_es-es_703034b0ba0357e4\WindowsSistema.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usbceip.resources_31bf3856ad364e35_10.0.19041.1_it-it_de82d56883de324a\operativoSistema.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_10.0.19041.207_none_3eab5ab615eaf290\MicrosoftOperating.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..rsist-rll.resources_31bf3856ad364e35_10.0.19041.1_es-es_1c0e31166986b4a6\msdaprsrmsdaprsr.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\MicrosoftMicrosoft.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\ja\RCX2F22.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.19041.264_none_34dcc771aa7f6b3b\webplatstorageserverwebplatstorageserver.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Linq.Resources\3.5.0.0_ja_b77a5c561934e089\RCX6A3.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\resourcesoperativo.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\1033\vbc7uiFramework9.0.30729.9141.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-base_31bf3856ad364e35_10.0.19041.264_none_0afe35891ca55376\MSCMSWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..s.utility.resources_31bf3856ad364e35_10.0.19041.1_de-de_78a372d236c34738\Windowsresources.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_appinstallerprompt-desktop.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cede1618524832a6\DesktopWindows10.0.19041.1.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols.Resources\2.0.0.0_es_b03f5f7f11d50a3a\MicrosoftSystem.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols.Resources\2.0.0.0_es_b03f5f7f11d50a3a\RCX682.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasifmon.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_070f5c367f99b4ce\ifmonWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00000412_31bf3856ad364e35_10.0.19041.1_none_a7f94c8737ad2028\kbdkorWindows10.0.19041.1.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\WindowsWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7363b8f21a99a540\WindowsWINVER.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\msil_microsoft.build.con..sion.v3.5.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_677e4c5bc149c75b\Microsoftresources285.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\WindowsAppV.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\es\RCXE312.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\es\resourcescompatibility.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\WindowsWSMan.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\RCX9C14.tmp 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..omponents.resources_31bf3856ad364e35_10.0.19041.1_de-de_e92b3608b1b54436\MicrosoftLocationNotificationWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-predictionunit_31bf3856ad364e35_10.0.19041.746_none_11630d8270062940\InternalWindows.exe 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe 5052 8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe"C:\Users\Admin\AppData\Local\Temp\8bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD5dee28ed9c6ef92d83aab7cb1108822e1
SHA1728be21260c676618b462af8357e3020f8b41065
SHA2565f6d76b41553f9b6ca1ef83bfd8dc9905a528678de9725e4f97c3e1f84a25b9b
SHA5126035744fc0e6a56deb0b979ff7869793fb0d2fe93c48c55b078f60260f89474676e7632d629b7dea77542dee6a749f8b92283ddf1abb2a7ec2eb90e36b442215
-
Filesize
755KB
MD55496582c7c3da3246ad732acf85e87a5
SHA1ba3c35a73f77992c2927492a79038373b710bded
SHA2568bb294a07b2a3e489d1fe5f318dbcce102a10f98cb5348f027f0ce93219432d4
SHA5126c7b7d3fdc27c319e36ca3889b4db169516c848a34597a0bd7e7454312e7a86220c5ae131deff24724ab82b70adf3f66507f1d98414d55f3468120b5ba82395b
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\RCX9BC3.tmp
Filesize756KB
MD5df1bdfd96feee171f10b3a6aa175ece7
SHA1b64e643f2fe7310ccb05fdc93c0830173693b842
SHA25601b4f11e143139ec2f2287ddd52e13b659d544ce04a1ef84a9fc4a29f27b4703
SHA512906f6f91478885d0ccc6602815878e9d5b3e203c19c35de1806813c572f8dfffed3ca5049fd806d3b87c34289d1b4468cec27dcc2a10fa33eb3c032586b93d0c