Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 18:21
Behavioral task
behavioral1
Sample
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe
Resource
win7-20231129-en
General
-
Target
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe
-
Size
4.2MB
-
MD5
1d5a0ca464c1573cc629e02efb32a152
-
SHA1
37d9e651469fe9eb5fcc5fe93a13e87f114b41b7
-
SHA256
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784
-
SHA512
e33af28af79747a3800cca4c9a2208bf011bbd577b4593486faedab939adb8f10478da697b9c7f479c51b6e8db3c6c52606f1055b4decf7aab3dc0807aa22ad8
-
SSDEEP
98304:Dg2KK3z9OP+9Rqc7b5nBnEQWoYIsaOyk3xd:E2KKjQ+9RZ7RBTYSOyC3
Malware Config
Extracted
gozi
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1424-118-0x0000000000400000-0x0000000000617000-memory.dmp family_blackmoon -
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
UPX dump on OEP (original entry point) 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1424-0-0x0000000000400000-0x0000000000617000-memory.dmp UPX C:\Program Files\7-Zip\Uninstall.exe UPX behavioral2/memory/1424-118-0x0000000000400000-0x0000000000617000-memory.dmp UPX -
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule C:\Windows\svchost.exe xmrig behavioral2/memory/1424-118-0x0000000000400000-0x0000000000617000-memory.dmp xmrig behavioral2/memory/3004-233-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-284-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-329-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-404-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-446-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-449-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-451-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-453-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-455-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-457-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-459-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-461-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-463-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3004-466-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3004 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1424-0-0x0000000000400000-0x0000000000617000-memory.dmp upx C:\Program Files\7-Zip\Uninstall.exe upx behavioral2/memory/1424-118-0x0000000000400000-0x0000000000617000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Drops file in System32 directory 64 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process File created C:\Windows\SysWOW64\OposHost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\ftp.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\printui.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\regedit.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\dpnsvr.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\forfiles.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\dpapimig.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\esentutl.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\print.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\subst.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\dfrgui.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\winrshost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\dccw.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\findstr.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\certutil.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\logagent.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\runonce.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\sfc.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\finger.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\driverquery.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\raserver.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\replace.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\unregmp2.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\cttune.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\cleanmgr.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\relog.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\sdbinst.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\choice.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\icsunattend.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\net1.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\ttdinject.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\curl.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\regsvr32.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\RpcPing.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\secinit.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\wermgr.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\dialer.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\ddodiag.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\doskey.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\mmc.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\RmClient.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\Utilman.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\wevtutil.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\upnpcont.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\convert.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\expand.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\netiougc.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\sethc.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\user.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Drops file in Program Files directory 64 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\Internet Explorer\iexplore.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateCore.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge_pwa_launcher.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\MicrosoftEdge_X64_122.0.2365.52.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\setup.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge_proxy.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\cookie_exporter.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_helper.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\Windows Mail\wab.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\ie_to_edge_stub.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge_proxy.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedgewebview2.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Drops file in Windows directory 64 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\AppVClient.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\f\SystemUWPLauncher.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\f\bootim.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\f\SndVol.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\f\autochk.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\ClipUp.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\Microsoft.AsyncTextService.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVStreamingUX.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.19041.1_none_0e40322ba49953c6\cacls.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\r\directxdatabaseupdater.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\CallingShellApp.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\windeploy.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.1_none_5eda5fa3fa7c0fb7\alg.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\r\tcblaunch.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\r\bfsvc.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\f\wbengine.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVNice.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\f\GameBarPresenceWriter.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvax64.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\EoAExperiences.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\r\EoAExperiences.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\f\tcblaunch.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\AssignedAccessLockApp.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.CscUnpinTool.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_26e3edd6087852fc\backgroundTaskHost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\backgroundTaskHost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\vmcompute.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\f\conhost.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\bthudtask.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\r\securekernel.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVNice.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\r\AddSuggestedFoldersToLibraryDialog.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.1_none_90e29eafea574969\psr.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browser_broker.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\r\vmcompute.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1_none_e9b79397c28488a5\pcalua.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\SpatialAudioLicenseSrv.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\wbengine.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\ScriptRunner.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\hh.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exesvchost.exedescription pid process Token: SeDebugPrivilege 1424 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Token: 33 1424 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Token: SeIncBasePriorityPrivilege 1424 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Token: SeIncBasePriorityPrivilege 3004 svchost.exe Token: SeLockMemoryPrivilege 3004 svchost.exe Token: SeLockMemoryPrivilege 3004 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exepid process 1424 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription pid process target process PID 1424 wrote to memory of 3004 1424 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe svchost.exe PID 1424 wrote to memory of 3004 1424 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe"C:\Users\Admin\AppData\Local\Temp\064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
4.2MB
MD5842a640a07aaee76c9b9d7885e3bdf04
SHA1aeef9363dde8788237c464b44698e67632e13900
SHA2564750984c30f14073c792b98ee007714356a929ed44ae5234e73ad2e10a09c929
SHA512fc89f686e36cde7348d767bc8ea92ea095885796f94d0c0bc84b045b7eaf200b571b2d774f2af7c29ee6e48a149ee0ef850ed8175b2f690d0ee2b08a65115746
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
memory/1424-0-0x0000000000400000-0x0000000000617000-memory.dmpFilesize
2.1MB
-
memory/1424-118-0x0000000000400000-0x0000000000617000-memory.dmpFilesize
2.1MB
-
memory/3004-404-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-453-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-329-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-233-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-446-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-449-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-451-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-284-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-455-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-457-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-459-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-461-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-463-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3004-466-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB