Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 21:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe
-
Size
52KB
-
MD5
cef432c819b0308cfcb37261a6632dc2
-
SHA1
7334ab7e9ac53c8c842be8be7870225b0244e7eb
-
SHA256
42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212
-
SHA512
a608270919942acb4b4dc7384a92805adf94651072bd9d0810cd9365be169d63bf7cc8ed2a03e70013f7c9c6aefe6246a8872fabc64ffb143192816d1bbd274c
-
SSDEEP
768:DlQ4hrvaEGU4aikqykezg2XpfYWBCjYioRo4b6l5:5LhE1Dezg2ZfYW1oGY5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\J: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\N: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\O: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\S: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\V: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\Z: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\H: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\L: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\Q: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\U: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\W: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\X: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\G: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\K: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\M: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\P: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\R: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\T: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\Y: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened (read-only) \??\I: 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\WEVTUTIL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\WINVER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\NOTEPAD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\SEARCHINDEXER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\WAITFOR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\XWIZARD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\LABEL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\DRVINST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\MSIEXEC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\MSPAINT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\REGEDT32.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\DRVINST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\MSTSC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\ATTRIB.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\FTP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\SHARED\IMEPADSV.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\NEWDEV.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\FINGER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMETC10\IMTCPROP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\SETUPSNK.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\TRACERPT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHINDEXER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\SORT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\WIMSERV.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\NTPRINT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\ROBOCOPY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\CHKDSK.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\EFSUI.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\NTKRNLPA.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\PERFMON.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\WVMIC.INF_AMD64_NEUTRAL_B94EB92E8150FA35\VMICSVC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMCCPHR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\ESENTUTL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\GETMAC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\TZUTIL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\UPNPCONT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\ICARDAGT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\NSLOOKUP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\REPLACE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\DISKPERF.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\PRINT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\SDIAGNHOST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPDSVR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\MFPMP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\RASERVER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESPROTECTION.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\TAKEOWN.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\AUTOCONV.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\CERTUTIL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\SYSKEY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\USER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SYSWOW64\WBEM\WMIC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\INSTNM.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WINMGMT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\TABTIP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\POLICYTOOL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBEUPDATERINSTALLMGR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSACCESS.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\POWERPNT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KINIT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\PACK200.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\SETUP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLECRASHHANDLER64.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JINFO.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\LIB\LAUNCHER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\LICLUA.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\IECONTENTSERVICE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEDIAGCMD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\ODEPLOY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAW.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAWS.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\ORBD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DOWNLOAD\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\CHROME_INSTALLER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCONSOLE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OARPMANY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\PPTICO.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAW.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SERVERTOOL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MINESWEEPER\MINESWEEPER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\HEARTS\HEARTS.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCMDRUN.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JHAT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KTAB.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\ORBD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JDB.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\SETUP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ADOBECOLLABSYNC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPREARM.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTATD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\NARRATOR\6.1.0.0__31BF3856AD364E35\NARRATOR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..RNATIONAL-TIMEZONES_31BF3856AD364E35_6.1.7601.17514_NONE_736D5BE520319B24\TZUPD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-DISKPART_31BF3856AD364E35_6.1.7601.17514_NONE_6ADFCF45F42EFFCF\DISKPART.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..AC-SQL-CLICONFG-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_CC12387F7062EB3B\CLICONFG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ETPC-MATHINPUTPANEL_31BF3856AD364E35_6.1.7601.17514_NONE_28C78887678AFBB1\MIP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINRE-RECOVERYTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_3142C61B8ADA510F\REAGENTC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WPF-PRESENTATIONHOSTEXE_31BF3856AD364E35_6.2.7601.17514_NONE_96490604D588C19B\PRESENTATIONHOST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_73E472E09A1A05D1\WMPSHARE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-S..OR-NATIVE-SERVERBOX_31BF3856AD364E35_6.1.7601.17514_NONE_71C62979C253E895\RMACTIVATE_SSP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NARRATOR-NONMSIL_31BF3856AD364E35_6.1.7601.17514_NONE_8B63C5E0DB87FDE8\NARRATOR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-T..ETPC-MATHINPUTPANEL_31BF3856AD364E35_6.1.7601.17514_NONE_331C32D99BEBBDAC\MIP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\PRESENTATIONFONTCACHE\3.0.0.0__31BF3856AD364E35\PRESENTATIONFONTCACHE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\EHOME\WOW\EHEXTHOST32.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_6.1.7601.17514_NONE_905283BDC3E1D2D8\WINDEPLOY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_SECURITY-MALWARE-WINDOWS-DEFENDER_31BF3856AD364E35_6.1.7601.17514_NONE_B5E2B6396ECEA306\MSASCUI.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..INSTALLERANDPRINTUI_31BF3856AD364E35_6.1.7601.17514_NONE_3ECEEF6140EC9728\PRINTUI.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..UNTERINFRASTRUCTURE_31BF3856AD364E35_6.1.7601.17514_NONE_DA00AD1949E715AD\UNLODCTR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-REMOTEASSISTANCE-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_9DA1B3254FF796E9\SDCHANGE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-DEVICEPAIRINGAPP_31BF3856AD364E35_6.1.7600.16385_NONE_6F74B7D163601DA2\DEVICEPAIRINGWIZARD.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\EHOME\EHEXTHOST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NBTSTAT_31BF3856AD364E35_6.1.7600.16385_NONE_FA057619380FF901\NBTSTAT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REGINI_31BF3856AD364E35_6.1.7600.16385_NONE_684B2E15D381EA25\REGINI.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-OCSETUP_31BF3856AD364E35_6.1.7601.17514_NONE_E5849BE1BD89E07E\OCSETUP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WFSERVICESREG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORSVW.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-N..PROTECTION-STATUSUI_31BF3856AD364E35_6.1.7600.16385_NONE_998FF5C741AE3FB1\NAPSTAT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUPCL_31BF3856AD364E35_6.1.7601.17514_NONE_B6D50B4301E77815\SETUPCL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-W..ION-TWAINCOMPONENTS_31BF3856AD364E35_6.1.7601.17514_NONE_8B399E33BA72BED9\TWUNK_32.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OXGAMES-MINESWEEPER_31BF3856AD364E35_6.1.7600.16385_NONE_FE560F0352E04F48\MINESWEEPER.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\MSIL_WSATCONFIG_B03F5F7F11D50A3A_6.1.7601.17514_NONE_DD3A06567424A01B\WSATCONFIG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-NSLOOKUP_31BF3856AD364E35_6.1.7601.17514_NONE_CD87DDDBC4B4A790\NSLOOKUP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..I_INITIATOR_SERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_3899B0AD2BB77A86\ISCSICLI.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-M..PLAYER-SHELLPREVIEW_31BF3856AD364E35_6.1.7600.16385_NONE_26E76F2AC1492952\WMPRPH.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-OSK_31BF3856AD364E35_6.1.7600.16385_NONE_AA93298FBB4246F2\OSK.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SRDELAYED_31BF3856AD364E35_6.1.7600.16385_NONE_B252497A75D8A174\SRDELAYED.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-REGISTRY-EDITOR_31BF3856AD364E35_6.1.7600.16385_NONE_5A78515E29EA6F39\REGEDT32.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TZUTIL_31BF3856AD364E35_6.1.7601.17514_NONE_9CBE849A4E275C84\TZUTIL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.7601.17514_NONE_DBD4D2796675BC72\SEARCHFILTERHOST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-JAPANESE-MIGRATION_31BF3856AD364E35_6.1.7600.16385_NONE_6A5B38699F97E38D\IMJPPDMG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPISETUP_31BF3856AD364E35_6.1.7600.16385_NONE_C5E81C6AB4DB0C88\TAPIUNATTEND.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WAITFOR_31BF3856AD364E35_6.1.7600.16385_NONE_125AA78894E49F8F\WAITFOR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-IEINSTAL_31BF3856AD364E35_8.0.7601.17514_NONE_055D8A4166E66F09\IEINSTAL.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_7CF343CAC8A829EC\ATTRIB.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGBROWSERS_B03F5F7F11D50A3A_6.1.7600.16385_NONE_96421D40C0E2903E\ASPNET_REGBROWSERS.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETPLWIZ-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_494BA66D2A12EFC3\NETPLWIZ.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OOBE-MACHINE_31BF3856AD364E35_6.1.7601.17514_NONE_6BA44FA419D13382\MSOOBE.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_6.1.7601.17514_NONE_BF4980401574A899\TYPEPERF.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..WSUPDATECLIENT-CORE_31BF3856AD364E35_7.5.7601.17514_NONE_1F3413AFC64D10C5\WUAUCLT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-ICARDAGT_EXE_31BF3856AD364E35_6.1.7600.16385_NONE_8DCC9C6F8B58A5EB\ICARDAGT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WPF-TERMINALSERVERWPFWRAPPEREXE_31BF3856AD364E35_6.1.7600.16385_NONE_80543131E5508A75\TSWPFWRP.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ROPERTIESPROTECTION_31BF3856AD364E35_6.1.7600.16385_NONE_BFA748753634BA48\SYSTEMPROPERTIESPROTECTION.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-WORKSPACERUNTIME_31BF3856AD364E35_6.1.7601.17514_NONE_848B402BF3E1C3B1\WKSPRT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-CLEANMGR_31BF3856AD364E35_6.1.7600.16385_NONE_6D1A8C84BEDF66A4\CLEANMGR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-P..RANDPRINTUI-NTPRINT_31BF3856AD364E35_6.1.7601.17514_NONE_F20AE427DBAE4FAF\NTPRINT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX35CDF-CSD_CDF_INSTALLER_31BF3856AD364E35_6.1.7600.16385_NONE_58326E688D4907C6\WFSERVICESREG.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGSVCS.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\JSC.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_6.1.7600.16385_NONE_655452EFE0FB810B\PKGMGR.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TASKHOST_31BF3856AD364E35_6.1.7601.22172_NONE_86AB4A318A459FDA\TASKHOST.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-MAGNIFY_31BF3856AD364E35_6.1.7600.16385_NONE_6E042D8FFA037534\MAGNIFY.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-OS-KERNEL_31BF3856AD364E35_6.1.7601.21863_NONE_6E8A5C3D2BAC37E9\NTKRNLPA.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-PING-UTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_A907FB2AF12E5DC6\PATHPING.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-IE-IEXPRESS_31BF3856AD364E35_8.0.7600.16385_NONE_7F0C7A3C17077FCE\WEXTRACT.EXE 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2228 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2228 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe 2228 42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe"C:\Users\Admin\AppData\Local\Temp\42a49b9a3407d026b33461373e3966e25cc2d198de84f5b69bbd6eeed6258212.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2228