Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 06:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5964aee3baa95a6c5161733f1fd7ef50N.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5964aee3baa95a6c5161733f1fd7ef50N.exe
-
Size
52KB
-
MD5
5964aee3baa95a6c5161733f1fd7ef50
-
SHA1
a302b456b7bed76934ebb90efa3eccbbacbb0277
-
SHA256
d0131d8e7b41ef0449a0c3fa08ed9688cf62250219ef95975a8299c541538e91
-
SHA512
0b16a71a2d86d33c881c19d102d2a4f59cabf0daed2091ad34ce8c4dd8efc671fb782b3ca6129e7ad2075136ac10f60431639583a5ca3000fd3799025bec1df3
-
SSDEEP
768:DlQ4hrvaEGU4aikqykezg2XpfYGjYioRoB4Sl5:5LhE1Dezg2ZfYDoKQ5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\N: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\Q: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\X: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\L: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\M: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\R: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\S: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\V: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\E: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\G: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\K: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\Y: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\H: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\I: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\O: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\U: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\W: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\J: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\P: 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened (read-only) \??\T: 5964aee3baa95a6c5161733f1fd7ef50N.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\COM\MIGREGDB.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\RDRLEAKDIAG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\SDBINST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\IEXPRESS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEX.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\NEWDEV.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\MTSTOCOM.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\QUICKASSIST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\MSTSC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\BYTECODEGENERATOR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\HH.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\TAPIUNATTEND.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\CIPHER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\ONEDRIVESETUP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\RUNAS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\HOSTNAME.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\MOUNTVOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WEVTUTIL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\UPNPCONT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\PRESENTATIONHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\SNDVOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\CLIP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\COLORCPL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\NETCFGNOTIFYOBJECTHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\PREVHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\CMMON32.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEBARPRESENCEWRITER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCAD32.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\TSTHEME.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WHOAMI.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\APPIDTEL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\COMPACT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEPADSV.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\ROUTE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDICON.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MIXEDREALITY.PORTAL_2000.19081.1301.0_X64__8WEKYB3D8BBWE\MIXEDREALITYPORTAL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCALCULATOR_10.1906.55.0_X64__8WEKYB3D8BBWE\CALCULATOR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SKYPESRV\SKYPESERVER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\ORBD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE16\OSPPREARM.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.DBCONNECTION64.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\NATIVE2ASCII.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\PWAHELPER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS NT\ACCESSORIES\WORDPAD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SETLANG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JABSWITCH.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\SERVERTOOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WINWORD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOICONS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\DATABASECOMPARE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADELRCP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_86687\JAVA.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEAPP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\INTEGRATEDOFFICE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERVERTOOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\CLVIEW.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\IECONTENTSERVICE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATEBROKER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLECRASHHANDLER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICEC2RCLIENT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\UNPACK200.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SERVERTOOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSOUNDRECORDER_10.1906.1972.0_X64__8WEKYB3D8BBWE\SOUNDREC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRSERVICESUPDATER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERIALVER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX45.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTATD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOASB.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OUTICON.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\ORBD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JRUNSCRIPT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTAT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PUBS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ARH.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.147.37\MICROSOFTEDGEUPDATEONDEMAND.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JPS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KEYTOOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JP2LAUNCHER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSQRY32.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_SECURITY-OCTAGON-BROKER_31BF3856AD364E35_10.0.19041.84_NONE_51AE5C25BAF813FF\SGRMLPAC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINER-MANAGER_31BF3856AD364E35_10.0.19041.1266_NONE_07A5D18B92D8B668\CMIMAGEWORKER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.19041.1_NONE_171488549E32A4D3\LOGMAN.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..WSUPDATECLIENT-CORE_31BF3856AD364E35_10.0.19041.1288_NONE_23AA03725EC9354A\R\WUAUCLT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-REMOTEASSISTANCE-EXE_31BF3856AD364E35_10.0.19041.1_NONE_F79DCF01D5A416BD\SDCHANGE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS32.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LXSS-WSLHOST_31BF3856AD364E35_10.0.19041.117_NONE_9BE21F0EF860B570\F\WSLHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\MSIL_IEEXEC_B03F5F7F11D50A3A_10.0.19041.1_NONE_3FC8DDFD98AD3137\IEEXEC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHELL-CUSTOMSHELLHOST_31BF3856AD364E35_10.0.19041.1202_NONE_FD57358454385601\CUSTOMSHELLHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.19041.1_NONE_E8B8012DEE3BA92E\HOSTNAME.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.1151_NONE_EC390BD802A1C630\R\SEARCHFILTERHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.19041.1202_NONE_4132A4047D5D53B2\F\APPVNICE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-HVSI-MANAGER_31BF3856AD364E35_10.0.19041.1202_NONE_7CDAD2E52790705D\R\HVSIMGR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-FILTERMANAGER-UTILS_31BF3856AD364E35_10.0.19041.1_NONE_D9D36AD7F915F657\FLTMC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.19041.153_NONE_F3A9DC0FE254A157\WMPCONFIG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CASTSERVER_31BF3856AD364E35_10.0.19041.746_NONE_A5986ECA8FD4063B\F\CASTSRV.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..TNET-MUA-HOSTSERVER_31BF3856AD364E35_10.0.19041.1_NONE_86E0E6CE46C9ED74\WINRTNETMUAHOSTSERVER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\MSIL_SMSVCHOST_B03F5F7F11D50A3A_10.0.19200.110_NONE_30A09D63C4775424\SMSVCHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_38869341091832BE\F\MOFCOMP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ESSLOCKAPP.APPXMAIN_31BF3856AD364E35_10.0.19041.844_NONE_15E5BFCD83A1911A\ASSIGNEDACCESSLOCKAPP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..RVICES-ADAM-INSTALL_31BF3856AD364E35_10.0.19041.1_NONE_D2C567B17279A950\ADAMUNINSTALL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FAX-SERVICE_31BF3856AD364E35_10.0.19041.804_NONE_8B46258BDEFA0BEB\R\FXSSVC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-COMPLUS-SETUP_31BF3856AD364E35_10.0.19041.1_NONE_9F98E6CC8EABB4CA\MTSTOCOM.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..RISECLIENTSYNC-HOST_31BF3856AD364E35_10.0.19041.1202_NONE_42D3A7D52BCB0F8D\WORKFOLDERS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFTWINDOWS-UNDOCKEDDEVKIT.APPXMAIN_31BF3856AD364E35_10.0.19041.488_NONE_7201E1DC944D1765\UNDOCKEDDEVKIT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TPM-TOOL_31BF3856AD364E35_10.0.19041.1202_NONE_7D4EA219D613C9D8\R\TPMTOOL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-HELP-CLIENT_31BF3856AD364E35_10.0.19041.1151_NONE_E0E8A531E34051A9\F\HELPPANE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SECURITYCENTER-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_9972EDDE9B98690C\F\WSCADMINUI.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_NETWORKING-MPSSVC-NETSH_31BF3856AD364E35_10.0.19041.1151_NONE_2E15548DB03A22C8\CHECKNETISOLATION.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEPLOYMENT_31BF3856AD364E35_10.0.19041.746_NONE_D9E841974C1D46E8\R\SETUPUGC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UTILMAN_31BF3856AD364E35_10.0.19041.789_NONE_E07ABBE9902A4F60\UTILMAN.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-M..-MANAGEMENT-CONSOLE_31BF3856AD364E35_10.0.19041.1_NONE_CFB902E649608730\MMC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MDMAGENT_31BF3856AD364E35_10.0.19041.1_NONE_FAEDBAA2BD7D01C2\MDMAGENT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RPC-LOCATOR_31BF3856AD364E35_10.0.19041.1_NONE_8525A0B08BF57BBB\LOCATOR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TRUSTEDINSTALLER_31BF3856AD364E35_10.0.19041.1202_NONE_05CD606E025D0D96\R\TRUSTEDINSTALLER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-COM-SURROGATE-CORE_31BF3856AD364E35_10.0.19041.1_NONE_F53047DAAA565A5E\DLLHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..NGSHELLAPP.APPXMAIN_31BF3856AD364E35_10.0.19041.84_NONE_24F8AAFDACEAF0B5\CALLINGSHELLAPP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.19041.1266_NONE_802F96A5044B0FBE\R\WMPCONFIG.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PICKERHOST_31BF3856AD364E35_10.0.19041.1023_NONE_228521F0037FD996\R\PICKERHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PEOPLEEXPERIENCEHOST_CW5N1H2TXYEWY\PEOPLEEXPERIENCEHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LEGACYHWUI_31BF3856AD364E35_10.0.19041.1_NONE_98652FE6E79E6FC9\HDWWIZ.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-IEEXEC_B03F5F7F11D50A3A_10.0.19041.1_NONE_6A5DE40C0A30489E\IEEXEC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-USO-DTUHANDLER_31BF3856AD364E35_10.0.19041.844_NONE_C0D0CB934C1C1F17\F\DTUHANDLER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX35LINQ-VB_COMPILER_ORCAS_31BF3856AD364E35_10.0.19041.1_NONE_4BF3621A8EBE2EE3\VBC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..LITY-EOAEXPERIENCES_31BF3856AD364E35_10.0.19041.153_NONE_C283D2CF01B0B7D8\R\EOAEXPERIENCES.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..VERYCENTER-PLATFORM_31BF3856AD364E35_10.0.19041.964_NONE_21209B01F08AFD33\SYSTEMRESETPLATFORM.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..STRUCTUREEXECUTABLE_31BF3856AD364E35_10.0.19041.1_NONE_ADF98E02F565C8FE\UNLODCTR.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REFSUTIL_31BF3856AD364E35_10.0.19041.1202_NONE_5F774093E49B3593\REFSUTIL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINUTIL_B77A5C561934E089_4.0.15805.0_NONE_FCD173BC1B434B81\ADDINUTIL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..LS-ADSCHEMAANALYZER_31BF3856AD364E35_10.0.19041.1_NONE_89E9F21ED63037F6\ADSCHEMAANALYZER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICECENSUS_31BF3856AD364E35_10.0.19041.1202_NONE_24329C73AFBD2316\F\DEVICECENSUS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHAREDACCESS_31BF3856AD364E35_10.0.19041.746_NONE_E2C6A972A81B8D2C\F\ICSUNATTEND.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ICES-APPCOMPATTOOLS_31BF3856AD364E35_10.0.19041.1_NONE_A9109D150B1BF064\ACINIUPD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SHIELD-PROVIDER_31BF3856AD364E35_10.0.19041.1266_NONE_1ABB9653828C3F41\F\SECURITYHEALTHHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\HVC.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BROWSER-BROKERS_31BF3856AD364E35_11.0.19041.746_NONE_581CCF386BA57D51\BROWSEREXPORT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASCLIENTTOOLS_31BF3856AD364E35_10.0.19041.1266_NONE_E40CA34E5DE298C9\R\RASDIAL.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LOCKAPP.APPXMAIN_31BF3856AD364E35_10.0.19041.844_NONE_C5675EA732C2EAA0\F\LOCKAPP.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MICROSOFTEDGE_31BF3856AD364E35_10.0.19041.264_NONE_EF195F564F00D259\MICROSOFTEDGE.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGSVCS.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINER-MANAGER_31BF3856AD364E35_10.0.19041.1266_NONE_07A5D18B92D8B668\R\CMPROXYD.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..ING-MANAGEMENT-CORE_31BF3856AD364E35_10.0.19041.746_NONE_092D70D1898E5FF9\DISMHOST.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..TE-ORCHESTRATORCORE_31BF3856AD364E35_10.0.19041.264_NONE_64B3F487E354744D\F\USOCOREWORKER.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WAASMEDIC_31BF3856AD364E35_10.0.19041.1165_NONE_A82485B8F343811F\R\WAASMEDICAGENT.EXE 5964aee3baa95a6c5161733f1fd7ef50N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4392 5964aee3baa95a6c5161733f1fd7ef50N.exe 4392 5964aee3baa95a6c5161733f1fd7ef50N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5964aee3baa95a6c5161733f1fd7ef50N.exe"C:\Users\Admin\AppData\Local\Temp\5964aee3baa95a6c5161733f1fd7ef50N.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4392