Analysis
-
max time kernel
130s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 03:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe
-
Size
52KB
-
MD5
87137a937071327c491fffbaf75efa4e
-
SHA1
1c1f7779c57ada6e321c9a5b7ec763af8ed2ba47
-
SHA256
d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33
-
SHA512
2ce4898d50fba7b6e67cad69987bbcad2dc7d5935ef1a846af42fc5be77acd66f40fc8fd77076cabb02ae2f039d0124e20949a57d712ea4e2402b84988e9862b
-
SSDEEP
768:FlQ4hrvaEGU4aikqykezg2XpfYkjYioRoPkOl5:fLhE1Dezg2ZfYpoM85
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\O: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\Q: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\X: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\L: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\N: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\U: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\W: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\G: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\H: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\I: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\S: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\T: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\M: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\P: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\R: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\V: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\Y: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\E: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\J: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened (read-only) \??\K: d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\EVENTVWR.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHINDEXER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SVCHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\BOOTCFG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\HELP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SUBST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\EDPNOTIFY.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEPANEL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\WEXTRACT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\RDRLEAKDIAG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\HDWWIZ.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CLOUDNOTIFICATIONS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\NETSTAT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCAD32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\RASDIAL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTRANSFERHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\ROUTE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\RUNONCE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\VERCLSID.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\WEVTUTIL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\KTMUTIL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\MSRA.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\PREVHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WINMGMT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\NETIOUGC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\PASSWORDONWAKESETTINGFLYOUT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\REGSVR32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0C0A-1000-0000000FF1CE}\MISC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ARH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\NOTIFICATION_HELPER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\APPLETVIEWER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JJS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSTICKYNOTES_3.6.73.0_X64__8WEKYB3D8BBWE\MICROSOFT.NOTES.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEAPP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSTORE_11910.1002.5.0_X64__8WEKYB3D8BBWE\WINSTORE.APP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAW.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\INTEGRATEDOFFICE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JDB.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSHARE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\CORTANA.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\INSTALL\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\CHROME_INSTALLER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SETLANG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.VP9VIDEOEXTENSIONS_1.0.22681.0_X64__8WEKYB3D8BBWE\CODECPACKS.VP9.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\ORBD.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\POLICYTOOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\LYNCICON.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SCREENSKETCH_10.1907.2471.0_X64__8WEKYB3D8BBWE\SCREENSKETCH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_104468\JAVAW.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAWS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KLIST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\COOKIE_EXPORTER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOADFSB.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXOUTLOOK.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMEOVERLAY_1.46.11001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATESETUP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\TNAMESERV.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\PACK200.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\ONEDRIVESETUP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.OFFICE.ONENOTE_16001.12026.20112.0_X64__8WEKYB3D8BBWE\ONENOTESHARE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_104468\JAVA.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KEYTOOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PJ11ICON.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\WIN32BRIDGE.SERVER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROLAYOUTRECOGNIZER\ACROLAYOUTRECOGNIZER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARMHELPER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JJS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\POWERPNT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PROTOCOLHANDLER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\INSTALL\{C02579D9-A0AB-42F6-B7D3-0D46468AED6D}\MICROSOFTEDGEUPDATESETUP_X86_1.3.187.37.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCMD.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIREGISTRY.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JABSWITCH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWS.PHOTOS_2019.19071.12548.0_X64__8WEKYB3D8BBWE\MICROSOFT.PHOTOS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\MICROSOFTEDGEUPDATE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..ONWAKESETTINGFLYOUT_31BF3856AD364E35_10.0.19041.1_NONE_623E57CB80E184B5\PASSWORDONWAKESETTINGFLYOUT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SHIELD-PROVIDER_31BF3856AD364E35_10.0.19041.84_NONE_9D98E005FB7852CA\SECURITYHEALTHHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SYNCHOST_31BF3856AD364E35_10.0.19041.746_NONE_51CF02378FC26DA3\SYNCHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-N..QUICKSTART.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_72535CA9B59A9515\F\NARRATORQUICKSTART.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..SKTOP.APPXMAIN.ROOT_31BF3856AD364E35_10.0.19041.264_NONE_A71C9F7FDCD899C5\R\SEARCHAPP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MULTIMEDIA-RRINSTALLER_31BF3856AD364E35_10.0.19041.746_NONE_F0E6F722EC2403D4\RRINSTALLER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_10.0.19041.1_NONE_1F65F7473443D565\CMSTP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..POLICY-CMDLINETOOLS_31BF3856AD364E35_10.0.19041.906_NONE_198D8D483AA30ED0\R\GPRESULT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCORE_31BF3856AD364E35_10.0.19041.1151_NONE_21B291C4F7BDB6E0\R\NFSCLNT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..ERVICING-MANAGEMENT_31BF3856AD364E35_10.0.19041.1_NONE_149AB09BAD09F1C1\DISM.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MSAUDITTOOLS_31BF3856AD364E35_10.0.19041.1_NONE_D7CAC98C90803A6A\AUDITPOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BLB-ENGINE-MAIN_31BF3856AD364E35_10.0.19041.264_NONE_C1C396DA5EA1410F\WBENGINE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINER-MANAGER_31BF3856AD364E35_10.0.19041.1266_NONE_07A5D18B92D8B668\R\CMIMAGEWORKER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..RARIES-SERVERCOMMON_31BF3856AD364E35_10.0.19041.906_NONE_87B019D7CEBD66D4\R\APPCMD.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..T-BYTECODEGENERATOR_31BF3856AD364E35_10.0.19041.1081_NONE_5F557B607E14F541\BYTECODEGENERATOR.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ATIBILITY-ASSISTANT_31BF3856AD364E35_10.0.19041.1266_NONE_A88C5999D8585853\R\PCALUA.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..ED-TELEMETRY-CLIENT_31BF3856AD364E35_10.0.19041.1266_NONE_14B8C34DBC1DF417\R\RUNEXEHELPER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..EGISTRATION-CMDLINE_31BF3856AD364E35_10.0.19041.1_NONE_F526198CAECD7792\DSREGCMD.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CASPOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..SCREENCONTENTSERVER_31BF3856AD364E35_10.0.19041.1_NONE_BD38794249E3D110\LOCKSCREENCONTENTSERVER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..N-TOOLS-COMMAND-LDP_31BF3856AD364E35_10.0.19041.1_NONE_05325E2F9F9E6B0A\LDP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FAX-SERVICE_31BF3856AD364E35_10.0.19041.1_NONE_6314A7411FA6F2EC\FXSSVC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..SERVICES-SESSIONMSG_31BF3856AD364E35_10.0.19041.746_NONE_18CBE45E21FB4FCB\F\SESSIONMSG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_OPENSSH-CLIENT-COMPONENTS-ONECORE_31BF3856AD364E35_10.0.19041.964_NONE_DDDEEA757B7FBBA7\SSH-KEYSCAN.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-INTERNATIONAL-UNATTEND_31BF3856AD364E35_10.0.19041.906_NONE_A892FAEF80A943DC\R\MUIUNATTEND.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TPM-TOOL_31BF3856AD364E35_10.0.19041.1202_NONE_7D4EA219D613C9D8\R\TPMTOOL.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_COMPILER_B03F5F7F11D50A3A_4.0.15805.0_NONE_73CC8B3E43BA1056\ASPNET_COMPILER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-UTILMAN_31BF3856AD364E35_10.0.19041.746_NONE_EAF7A50DC46D5592\R\UTILMAN.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX-MSCORSVW_EXE_B03F5F7F11D50A3A_10.0.19041.1_NONE_E0DEC3877978D84A\MSCORSVW.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..VERCOMMANDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_70349C6644208282\TSPROF.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LXSS-BASH_31BF3856AD364E35_10.0.19041.117_NONE_1DB60E061B48335A\R\BASH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-AUTOPLAY_31BF3856AD364E35_10.0.19041.1266_NONE_8FC08423F52C1606\WMLAUNCH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..SPACES-SPACEMANAGER_31BF3856AD364E35_10.0.19041.1266_NONE_BEE3DF875F7E71BB\F\SPACEMAN.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MULTIPOINT-WMSSESSIONAGENT_31BF3856AD364E35_10.0.19041.1_NONE_570D39E810AC0F64\WMSSESSIONAGENT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-F..TEMCOMPAREUTILITIES_31BF3856AD364E35_10.0.19041.1_NONE_C10C5C59091A9A90\COMP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_10.0.19041.928_NONE_B321F2C2AB7710A2\F\SDBINST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-REGISTRY-EDITOR_31BF3856AD364E35_10.0.19041.746_NONE_DC7CAA836F08AD57\REGEDT32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SENSORDATASERVICE_31BF3856AD364E35_10.0.19041.1_NONE_B3F4F49AC9993D28\SENSORDATASERVICE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MSINFO32-EXE_31BF3856AD364E35_10.0.19041.1_NONE_6C221EACCD6C91AE\MSINFO32.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-HOST-SERVICE_31BF3856AD364E35_10.0.19041.264_NONE_D58A0CA50A94510C\F\VMCOMPUTE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OMMANDLINE-ADAMSYNC_31BF3856AD364E35_10.0.19041.1081_NONE_6700B2D2D3C0055F\ADAMSYNC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKSETUP_31BF3856AD364E35_10.0.19041.746_NONE_FF52ABD5CB47BBE1\R\LPKSETUP.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..ONWAKESETTINGFLYOUT_31BF3856AD364E35_10.0.19041.746_NONE_8A469514405342FF\PASSWORDONWAKESETTINGFLYOUT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WEB-APP-HOST_31BF3856AD364E35_10.0.19041.789_NONE_1060D2D22DF7C6EB\WWAHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINRE-RECOVERYTOOLS_31BF3856AD364E35_10.0.19041.1_NONE_8B3EE1F81086D0E3\REAGENTC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MULTIPOINT-WMSSESSIONAGENT_31BF3856AD364E35_10.0.19041.746_NONE_7F157730D01DCDAE\R\WMSSESSIONAGENT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-COMPLUS-UI_31BF3856AD364E35_10.0.19041.746_NONE_8EA10E81A707D623\DCOMCNFG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-UTILITYVM-SETUPAGENT_31BF3856AD364E35_10.0.19041.1_NONE_CF994A1A65720FD5\WCSETUPAGENT.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGSVCS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..CYMANAGERBROKERHOST_31BF3856AD364E35_10.0.19041.746_NONE_5CC81A54CF095C95\F\EASPOLICYMANAGERBROKERHOST.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..INSTALLERANDPRINTUI_31BF3856AD364E35_10.0.19041.1237_NONE_556BA5D1DF8130AC\PRINTUI.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AXINSTALLSERVICE_31BF3856AD364E35_10.0.19041.153_NONE_B4F0BD83CFC7701E\F\AXINSTUI.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..CECONTROLLER-MINWIN_31BF3856AD364E35_10.0.19041.928_NONE_1D29B4735B607954\F\SERVICES.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ICACLS_31BF3856AD364E35_10.0.19041.1_NONE_F2FA56E679B879D1\ICACLS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VSSSERVICE_31BF3856AD364E35_10.0.19041.1_NONE_10BDDBFAB734FA42\VSSVC.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-IME-EASHARED-CCSHARED_31BF3856AD364E35_10.0.19041.1_NONE_965FBCBE4DF0916B\IMCCPHR.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RUNAS_31BF3856AD364E35_10.0.19041.1_NONE_202E011A312BAB1D\RUNAS.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CORRUPTEDFILERECOVERY_31BF3856AD364E35_10.0.19041.1_NONE_3DAAC563C824D4E0\COFIRE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CTTUNE_31BF3856AD364E35_10.0.19041.1_NONE_697599F55DE29EC6\CTTUNE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LXSS-WSLCONFIG_31BF3856AD364E35_10.0.19041.1151_NONE_15ECDE7059D11B7F\F\WSLCONFIG.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-AUTOPLAY_31BF3856AD364E35_10.0.19041.1_NONE_D0EBBE21DF584658\WMLAUNCH.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMPROPERTIESREMOTE_31BF3856AD364E35_10.0.19041.1_NONE_4AC6500CAB2B2113\SYSTEMPROPERTIESREMOTE.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPICORE_31BF3856AD364E35_10.0.19041.746_NONE_C2332356A565DF1C\DIALER.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SECURITY-TOKENBROKER_31BF3856AD364E35_10.0.19041.1266_NONE_22CCF50C942E2AC7\F\TOKENBROKERCOOKIES.EXE d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3764 d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe 3764 d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe"C:\Users\Admin\AppData\Local\Temp\d8ca20e29b7a7e06d4a2eea054281ea393acef94f1500a97ea5d0514a88e3b33.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3764