Analysis
-
max time kernel
1560s -
max time network
1561s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe
Resource
win10v2004-20240508-en
General
-
Target
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe
-
Size
79KB
-
MD5
725e65aa9cb9f4e2e7e85f6893cd189f
-
SHA1
b785900d47cae459aace67417c7b2df977c012f0
-
SHA256
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a
-
SHA512
7adddd2f38483ebf77d0cfd2967a02ebd2eaf6a7add751c6d5423034139f6d75b05d6a46b0bd3e36072882e4d7ad973612c2f2c610a16ce85515172bfa90f31b
-
SSDEEP
768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhYCDPdICDPdoQc:W7ZDpApYbWjIoPyPoLzV7c6Sh1dldoQc
Malware Config
Signatures
-
Renames multiple (16877) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 39 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\scfilter.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\pacer.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\gm.dls.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\wimmount.sys.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\qwavedrv.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\qwavedrv.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\tcpip.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\bfe.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\scfilter.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\pacer.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\tcpip.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\pacer.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\scfilter.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\pacer.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\bfe.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\pacer.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\qwavedrv.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\tcpip.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\tcpip.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\qwavedrv.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\scfilter.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\pacer.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\scfilter.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\bfe.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\qwavedrv.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\scfilter.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\bfe.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\qwavedrv.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\tcpip.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\bfe.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\bfe.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\tcpip.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Deletes itself 1 IoCs
pid Process 944 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\wiabr002.inf_amd64_neutral_b4ea26a49ad66560\Brmf3wia.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\ieetwcollectorres.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\es-ES\extrac32.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\mpssvc.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\winhttp.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\migwiz\fr-FR\wet.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\netevbda.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\IFC615G6.GPD.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\prnsv004.PNF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\fr-FR\mciqtz32.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnle002.inf_amd64_neutral_c7564163ba063094\Amd64\LRC231C.GPD.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\it-IT\AMDSBS.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\fr-FR\cmmon32.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\VMBusHID.sys.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\fms.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_neutral_ded8f26cdee953c3\mdmati.inf.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_neutral_716a306ec3899e04\mdmmcom.PNF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\prnsv003.inf.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\fr-FR\msscript.ocx.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\ja-JP\ComputerDefaults.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\mdmbtmdm.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\fr-FR\cpfilters.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\wlanapi.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\de-DE\netl1c64.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\RIAKRC3.GPD.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\aaclient.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\fsutil.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\sdbinst.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\sechost.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\C_28595.NLS.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\it-IT\netr7364.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\it-IT\prnca00a.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\AltTab.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\KBDPL.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\es-ES\diskpart.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_aliases.help.txt.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\dot3msm.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\Amd64\EP0NRE8T.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\dnscmmc.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\ieapfltr.dat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\NapiNSP.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\w32tm.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\de-DE\prnbr009.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\ja-JP\iastorv.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\adsmsext.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\ja-JP\tapi32.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\apilogen.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\gpapi.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMPNetworkSharingService-Package~31bf3856ad364e35~amd64~es-ES~6.1.7601.17514.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\hdwwiz.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\termsrv.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\tsgqec.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\ja-JP\rasmontr.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\regedit.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinOcr-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf3856ad364e35~amd64~de-DE~6.1.7601.17514.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\gpsvc.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\es-ES\wiahp001.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremium\license.rtf.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\setupugc.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\WfHC.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\ja-JP\bthpan.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLLIBR.DLL.IDX_DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD98.POC.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.ES.XML.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Mozilla Firefox\update-settings.ini.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107262.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0228959.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00018_.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR10F.GIF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGZIPC.XML.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLADD.FAE.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PS2SWOOS.POC.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\EXPTOOWS.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8B.GIF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.IDX.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.XML.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00242_.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME53.CSS.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00197_.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\cpu.css.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086420.WMF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099194.GIF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_de-de_55ff8d63613ab435\System.IdentityModel.Selectors.Resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-wwansvc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_829b3b2377ce705b.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_prnca00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97ca4e43fe58a032.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\wow64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_it-it_f8a82f3aa77ba93d\System.Management.Resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\PolicyDefinitions\en-US\WinCal.adml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-i..l-keyboard-00010409_31bf3856ad364e35_6.1.7600.16385_none_e9e1936b6e3201a2.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-msmpeg2enc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5ace9aeb4494cbd2.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_de-de_44c5489bf5781bbc.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_es_b77a5c561934e089\system.Resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iologgingdll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ddaae933bd6e174c\iologmsg.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\inf\netvfx64.PNF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Speech\Engines\SR\fr-FR\l1036.cw.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_64cdfa9d1a057b40\oflc.rs.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\x86_microsoft-windows-enhancedvideorenderer_31bf3856ad364e35_6.1.7601.17514_none_91a9e7972ac8981f\evr.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Help\mui\0C0A\qos.CHM.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7d4895febd530047_umpo.dll.mui_cac12e54.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b11048a8ca8c8b7d_webservices.dll.mui_eecc809d.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_wiaca00d.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_face40394b4a29a8\wiaca00d.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-taskscheduler-netapi_31bf3856ad364e35_6.1.7601.17514_none_67e6c3074ea71107.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_es-es_4067deb69ebef800\license.rtf.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Fonts\GILI____.TTF.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Input.Manipulations.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_prnca00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0aeae1fe3454a452\CNBBR327.DLL.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\FileMaps\$$_system32_de-de_licenses_eval_homebasic_81cee819fd2de388.cdf-ms.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ro-ro_a958e61749c0d36e.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-i..rityzones.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_87b4bd6165256f75.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\x86_microsoft-windows-i..p_profile.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_12d637b754d44b3b.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\msil_uiautomationclient.resources_31bf3856ad364e35_6.1.7600.16385_de-de_663e9e4cf86b1173\UIAutomationClient.resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_b385e35002562523\tipresx.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\x86_microsoft-windows-security-spp-ux-data_31bf3856ad364e35_6.1.7601.17514_none_61e7a64867b553a6.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\x86_microsoft-windows-deskperf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_abe31ffb8f99dfbb.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..ardplugin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d2965efffe95c63a\wevtfwd.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_23a3473d225f0e38\fms.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20280_31bf3856ad364e35_6.1.7600.16385_none_b124dadefdf62593\C_20280.NLS.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..inefiles-win32-apis_31bf3856ad364e35_6.1.7601.17514_none_0990ff400fc4c431_cscdll.dll_03753295.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-windowsmedia-codecs_31bf3856ad364e35_6.1.7601.17514_none_8ca5deed7f6e88d6.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netevent.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_810041d8c841663e\netevent.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-ie-infocard_31bf3856ad364e35_8.0.7600.16385_none_d14ab844f4f10649.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-w..iamanager.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b0fd827ed45fc1f6.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_64bafa4bfa871860\slcext.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-usbui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_aaf80adbb11253f5.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-w..er-common.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5b92bb3537f86bb3.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..ingengine.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7c10b6792f5a6f89\netcfgx.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-Windows-WinIP-Package~31bf3856ad364e35~amd64~ar-SA~7.1.7601.16492.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..rk-ctfmon.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_94f159b342ce8a8a\ctfmon.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deskmon.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c8ac92c52701a3a4.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\x86_microsoft-windows-r..sisengine.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e21b444aa158f1f7.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ShapeCollector.admx.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wlanui_31bf3856ad364e35_6.1.7601.17514_none_cab225b60372e411\wlanui.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_6.1.7600.16385_de-de_887be58659da2a79.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_prnbr002.inf-languagepack_31bf3856ad364e35_6.1.7600.16385_de-de_0bece4fd0ec1254e.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dc4a3190eb7d1265_acledit.dll.mui_5f932ccb.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1040\SetupResources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-help-sync.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0f1e8d7c089d2d35.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\wow64_microsoft-windows-a..structure-manifests_31bf3856ad364e35_6.1.7601.17514_none_064614d3fe52ac8a\advapi32.amx.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\de\SqlPersistenceProviderSchema.sql.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_e99b83c8fd064a06.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_microsoft-windows-tpm-tbs-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6c33acb94a100c0b.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\amd64_mdmbr007.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_18378972d6b89c06\BrSerIb.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e2c7a09849a324b2_netlogon.dll.mui_ecbeb9bd.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Catalogs\bd95dae54806ea928c0ff8403b4c0ea114e2ee8602f65d7e69558ecbe5711699.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\winsxs\Manifests\amd64_keyboard.inf-languagepack_31bf3856ad364e35_6.1.7600.16385_es-es_9b8ceb9db0e22d6d.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Fonts\smae1256.fon.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\servicing\Packages\Microsoft-Windows-UIAnimation-WinIP-Package~31bf3856ad364e35~amd64~ko-KR~7.1.7601.16492.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2876 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 944 2876 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 32 PID 2876 wrote to memory of 944 2876 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 32 PID 2876 wrote to memory of 944 2876 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 32 PID 2876 wrote to memory of 944 2876 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe"C:\Users\Admin\AppData\Local\Temp\a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A62C2D~1.EXE > nul2⤵
- Deletes itself
PID:944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5057a0310f959c4420dc8fc034f17c25c
SHA154998aaa41f5dd99788c31a1c8da12669e724592
SHA256faa7e1f5136da5edd74194c497e91d0c822a3f3f298f02310c8f8bd053981aad
SHA5124fbac41b6b2ef2f1722168aa5c85402d6dd18246a4c0bcaad156e1ccae01bcf0e57e07e19464646701c9039a0c9f4769fc2b069e70bdc948c27dac9894d224da
-
Filesize
89KB
MD5e198d4db3cf544c1d89b89e33bc35172
SHA18f7d9e56b9b1e796a89e10a41130ce11ee155a81
SHA2568a9594a9a59f7faeb9544837247ace4fae608f2b1d4451a592de45029c86f70b
SHA5128a0a80abaefd72846d4f5ec4904e3cf42a159fe897147e854572ff87afe50ec86037f264a7c797f152efd5403cad60e0f00c278c61f78f5ac736efc76e767505