Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe
-
Size
52KB
-
MD5
cb50be847a769122424e811b0a22aaf7
-
SHA1
07a61ae2503ac32f9f68a915cf8fa9f6ac518030
-
SHA256
f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8
-
SHA512
3a97191ef828f7c53175729a16276519d29882ab0ebde43b362da18201bca1cc99720ca5ba8f345e60475466451442f8d55c0dcc0a418239d580728282fd6aa4
-
SSDEEP
768:FlQ4hrvaEGU4aikqykezg2XpfY0jYioRoS8Gl5:fLhE1Dezg2ZfYZoXU5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\P: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\Q: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\T: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\E: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\G: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\K: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\M: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\U: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\V: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\Z: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\J: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\X: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\Y: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\H: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\I: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\N: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\R: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\L: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\S: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened (read-only) \??\W: f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\TASKLIST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MSINFO32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP_ISV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RUNDLL32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\SEARCHINDEXER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\TCPSVCS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\VERIFIER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\WLANEXT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WSMANHTTPCONFIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\DRIVERQUERY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\PUSHPRINTERCONNECTIONS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESADVANCED.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\WVMIC.INF_AMD64_NEUTRAL_B94EB92E8150FA35\VMICSVC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MIGWIZ\MIGSETUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RASDIAL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WEVTUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\CSCRIPT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\DNSCACHEUGC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\MTSTOCOM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\NETIOUGC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOCHK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CMMON32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MIGAUTOPLAY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\COMPUTERDEFAULTS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\DEVICEPAIRINGWIZARD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\EXTRAC32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MMC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\KTMUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\RESMON.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\SECEDIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNAS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNONCE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\DEVICEPROPERTIES.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\TYPEPERF.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\CERTUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\DPAPIMIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPDSVR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\NTOSKRNL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESHARDWARE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\WINRSHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\EFSUI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\MFPMP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\MSIEXEC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\DIVACX64.INF_AMD64_NEUTRAL_FA0F82F024789743\DITRACE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\BTHUDTASK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\ICARDAGT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPUEXC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\CREDWIZ.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\AUTOFMT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SYSWOW64\RDRLEAKDIAG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC10\IMTCPROP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCMD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSGEN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\IECONTENTSERVICE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAW.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KEYTOOL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\TNAMESERV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\UNPACK200.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPDMC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\DVD MAKER\DVDMAKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JABSWITCH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMIC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SOLITAIRE\SOLITAIRE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OUTLOOK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\LIB\VISUALVM\PLATFORM\LIB\NBEXEC64.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\SETUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCONSOLE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS NT\ACCESSORIES\WORDPAD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAW.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SERVERTOOL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OIS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JRUNSCRIPT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KLIST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\EXTCHECK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\TEXTCONV\WKSCONV\WKCONV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR APPLICATION INSTALLER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTATD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\TNAMESERV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOXMLED.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\POLICYTOOL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\LOGTRANSPORT2.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\READER_SL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\PACK200.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\PDIALOG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMID.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KINIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MINIDUMP-ANALYZER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\SETUP FILES\{AC76BA86-7AD7-1033-7B44-A90000000001}\SETUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\SETUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS SIDEBAR\SIDEBAR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KTAB.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\EHOME\EHTRAY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-O..CALMEDIADISC-WIZARD_31BF3856AD364E35_6.1.7600.16385_NONE_7680AA7B6195F2C6\DVDMAKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..INBOXGAMES-CHECKERS_31BF3856AD364E35_6.1.7601.17514_NONE_D467C138CBCE0B24\CHKRZM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-REMOTEASSISTANCE-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_9DA1B3254FF796E9\SDCHANGE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-DIANTZ_31BF3856AD364E35_6.1.7600.16385_NONE_A69C6A8F23F521F3\DIANTZ.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-PING-UTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_A907FB2AF12E5DC6\PATHPING.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_34CE5D95AD203BBE\ROUTE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\NGEN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-EHTRAY_31BF3856AD364E35_6.1.7601.17514_NONE_88FF132E83A8A275\EHTRAY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-N..PROTECTION-STATUSUI_31BF3856AD364E35_6.1.7600.16385_NONE_998FF5C741AE3FB1\NAPSTAT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_BD4644E077251730\CMSTP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-CONTROLPANEL_31BF3856AD364E35_6.1.7601.17514_NONE_3D9977977190CDC4\MULTIDIGIMON.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-CONTROL_31BF3856AD364E35_6.1.7600.16385_NONE_99424F610BD169DE\CONTROL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\WSATCONFIG\9683999D889DC0B8782C782E2FC1AEE5\WSATCONFIG.NI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_8.0.7601.17514_NONE_1196A9003B674A92\IEXPLORE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..S-REGKEYS-COMPONENT_31BF3856AD364E35_6.1.7601.17514_NONE_58B4153116C17B41\RDVGHELPER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..INSTALLERANDPRINTUI_31BF3856AD364E35_6.1.7601.17514_NONE_3ECEEF6140EC9728\PRINTUI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_EHEXTHOST32_31BF3856AD364E35_6.1.7600.16385_NONE_2A78E65A954611A5\EHEXTHOST32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-DIRECTSHOW-DVDUPGRD_31BF3856AD364E35_6.1.7600.16385_NONE_7D9CBCEC3DF8DA86\DVDUPGRD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\ACCICONS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WSATCONFIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-S..EXECUTIONPREVENTION_31BF3856AD364E35_6.1.7600.16385_NONE_C9B9BFC685ED05D3\SYSTEMPROPERTIESDATAEXECUTIONPREVENTION.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VBC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LUA_31BF3856AD364E35_6.1.7601.17514_NONE_047062A1736AF5B9\CONSENT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNDLL32_31BF3856AD364E35_6.1.7600.16385_NONE_33FA4336C49B998B\RUNDLL32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_6.1.7601.17514_NONE_632AE4BC5D173763\LOGMAN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\WSATCONFIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_6.1.7601.17514_NONE_FA8534AB236134C4\MFPMP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\TSCON.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-INPUTPANEL_31BF3856AD364E35_6.1.7601.17514_NONE_6FB51B358E21D75F\TABTIP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\NETSTAT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASAUTODIAL_31BF3856AD364E35_6.1.7600.16385_NONE_76239AAFB364E805\RASAUTOU.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MCUPDATE\6.1.0.0__31BF3856AD364E35\MCUPDATE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\COMSVCCONFIG\5F1A06C0108B2C81CDE1DC491D74043D\COMSVCCONFIG.NI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_6.1.7601.17514_NONE_EF38A8D0D05CC2C7\IMJPUEX.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-D..IME-EASHARED-IMEPAD_31BF3856AD364E35_6.1.7601.17514_NONE_3C93AC15FD731ACF\IMEPADSV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DPAPI-KEYS_31BF3856AD364E35_6.1.7600.16385_NONE_D9C7C4A2E721DA7E\DPAPIMIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_C79AEF32AB85D92B\CMSTP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..AGEENGINE-UTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_3580DEA4DEF227D4\ESENTUTL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKSETUP_31BF3856AD364E35_6.1.7601.17514_NONE_7F7F66788318015D\LPKSETUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..-DIAGNOSTIC-RESULTS_31BF3856AD364E35_6.1.7600.16385_NONE_84DB2473005C51CB\MDRES.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\CHANGE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-U..OUNTCONTROLSETTINGS_31BF3856AD364E35_6.1.7601.17514_NONE_85AC7BD736DDA285\USERACCOUNTCONTROLSETTINGS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-WAB-APP_31BF3856AD364E35_6.1.7601.17514_NONE_44B0C76C35D4B76D\WABMIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\NARRATOR\4CC02FAD33053737088D4C18267CA0A0\NARRATOR.NI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DPISCALING_31BF3856AD364E35_6.1.7600.16385_NONE_D63CC4DD74A11D0B\DPISCALING.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-DW_B03F5F7F11D50A3A_6.1.7600.16385_NONE_5A768666C3091014\DW20.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-SECINIT_31BF3856AD364E35_6.1.7600.16385_NONE_878E469B2E51CE80\SECINIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAIL-APP_31BF3856AD364E35_6.1.7601.17514_NONE_4F7E32F76654BD3C\WINMAIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WUSA_31BF3856AD364E35_6.1.7601.17514_NONE_0B2696EC2F3C656D\WUSA.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_INFOCARD_B77A5C561934E089_6.1.7601.17514_NONE_583A8C60C0B305A1\INFOCARD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DISKPART_31BF3856AD364E35_6.1.7601.17514_NONE_C6FE6AC9AC8C7105\DISKPART.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-NGEN_EXE_B03F5F7F11D50A3A_6.1.7601.17514_NONE_046C078DF2CAF5D8\NGEN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PERFORMANCETOOLSGUI_31BF3856AD364E35_6.1.7601.17514_NONE_04846DECEBF43C4C\PERFMON.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-RASCLIENTTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_6F1D25EC0A04D811\RASDIAL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-INTERNATIONAL-CORE_31BF3856AD364E35_6.1.7600.16385_NONE_459F562FF37206DD\MUIUNATTEND.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.7601.17514_NONE_D18028273214FA77\SEARCHINDEXER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-SECURITY-SYSKEY_31BF3856AD364E35_6.1.7600.16385_NONE_1838EF0586D5AF46\SYSKEY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3068 f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe 3068 f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe"C:\Users\Admin\AppData\Local\Temp\f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3068